The commercial phishing-as-a-service (PhaaS) toolkit known as Greatness has become the latest crimeware solution to add support for device code phishing, a rapidly growing cyber threat that abuses the legitimate OAuth 2.0 Device Authorization Grant to bypass Multi-Factor Authentication (MFA) and seize control of user accounts.
“Greatness supports AiTM [adversary-in-the-middle] credential and token theft, device code phishing, and OAuth consent abuse, all from the same operator panel and shared backend infrastructure,” ZeroBEC said in a report shared with The Hacker News detailing the PhaaS kit’s latest capabilities.
“The platform now supports AiTM token theft, device code phishing, OAuth consent abuse, and multiple target platforms, including iCloud, Yahoo, and Google Workspace. This evolution reflects the broader trend of PhaaS platforms expanding from simple credential harvesting to integrated attack ecosystems.”
The phishing platform was first publicly documented by Cisco Talos in May 2023, highlighting how threat actors are incorporating it in their attacks to target Microsoft 365 business users since at least mid-2022.
Designed as a way to lower the barrier of entry for cybercrime, access to Greatness is facilitated through a subscription available on its public-facing Telegram channel (@GreatnessPage) that has more than 3,250 subscribers and serves as a central hub for announcements and feature updates.
Aspiring cybercriminals can obtain a subscription starting from $289 per month, up from the $120 per month figure reported back in January 2024. The subscription provides access to an operator that includes a dashboard with campaign statistics, domain configuration, CAPTCHA selection, and over 11 downloadable lure templates covering voicemail, document sharing, and QR codes, among others.
Operator registration, license provisioning, and support are offered via a dedicated Telegram bot (@gr8managerbot), while licenses can be procured or renewed by sending a message to the “@greatnessmgr” account, the developer handle that oversees operator support and platform development.
In a post shared in November 2025, the operators of the Telegram channel claim that Greatness keeps stolen cookies safe and secure via one-way hash protection and that the information can be extracted only by the customers with their Telegram account 2FA code –
When you logged in with your telegram account and you insert 2FA in your side will create a token that only can access your logs so be sure only person can access is you as you see all info is hashed. Only way is accessing your telegram account so keep it safe and everything will be fine!
The most important thing for any service user is privacy. We respect all users’ privacy because we have been in this business for 8 years and prioritize everything to provide you the best experience. Unlike others, we are always honest with our customers.
Those who purchase a subscription by providing their Telegram chat ID and a bot API token can access the panel through an “O365 Panel” login page that requires a user ID and a 9-character license key. Upon successful registration, customers are provisioned with a dashboard and an operator-specific domain in the format: “api-[token].[base-domain].”
The dashboard is a one-stop shop that offers comprehensive campaign statistics, including the cookies captured and a heat map of victims. It also includes a links configuration page to select their phishing domain, CAPTCHA type, background theme, and the method for saving cookies, while the attachments section provides more than 11 downloadable and ready-to-use phishing lure templates that are packaged as ZIP files.
“Observed templates include: AudioLogin, ChatAssistance, WindowsExplorer, Voicemail, OneDrive, QR, VideoPlayer, and additional variants,” ZeroBEC said. “Each template contains pre-built HTML, PDF redirectors, SVGs, and letter templates, lowering the barrier to entry so operators do not need to build lures from scratch.”
Victims who end up interacting with a booby-trapped link embedded in the phishing email traverse through a five-stage redirect chain that implements anti-analysis protections, User-Agent fingerprinting, and a CAPTCHA gate, before taking them to the final destination, which can be either an AiTM proxy or a device code endpoint.
The device code phishing branch is a new addition to Greatness, allowing cybercriminals to leverage the OAuth device authorization grant flow to silently obtain tokens without user interaction.
“The first big shift was adversary-in-the-middle phishing, where a proxy site sits between the user and Microsoft and relays the login in real time to capture the session cookie,” Trend Micro said in an analysis published late last month.
“Device code phishing is the next step, and in some ways, it is cleaner for the attacker. There is no fake login site to build or to get blocked, and there is nothing visually wrong for the user to notice, because the page they enter their password on really is Microsoft. The only unusual thing is a short code and a plausible reason to enter it.”
Recent campaigns relying on the PhaaS kit have used spoofed RingCentral voicemail lures that bypass email gateways by taking advantage of safe sender exclusions and land on the victims’ inbox despite failing SPF, DKIM, and DMARC checks. This, in turn, exploits the fact that the target is a legitimate RingCentral customer.
While threat actors have impersonated RingCentral in various phishing campaigns in the past, the latest set of attacks adds a new dimension.
“The emails are not merely impersonating RingCentral; they are exploiting the trust configuration that exists because the target is an actual RingCentral customer,” ZeroBEC said.
“Any vendor breach that exposes a customer list simultaneously exposes which organizations are likely to have that vendor’s domain on their safe sender lists. Defenders should treat vendor breach disclosures as a trigger to audit and tighten email exclusion rules for the affected vendor’s domains.”
An analysis of post-compromise activity shows that harvested authentication tokens are replayed within minutes from dedicated proxy infrastructure, followed by enumerating various victim Microsoft 365 resources, such as Outlook, Teams, SharePoint, Exchange, OneDrive, contacts, calendars, and other registered applications, via the Microsoft Graph API.
ZeroBEC said it observed one of the AiTM proxy IP addresses (“38.248.95[.]214”) actively authenticating against a victim’s Microsoft 365 account more than two weeks after the initial phishing campaign, indicating how the prolonged validity of the tokens can grant attackers continued access for extended periods.
Other post-compromise actions recorded by Microsoft in conjunction with device code phishing attacks involve the threat actor registering new devices within minutes of the breach to generate a Primary Refresh Token (PRT) for long-term persistence, and waiting several hours before setting up malicious inbox rules or exfiltrating sensitive email data to avoid immediate detection.
The development comes as phishing continues to be the primary initial access vector, with attackers ramping up cascaded phishing campaigns, where the trust associated with a legitimate, compromised account is leveraged to launch hyper-personalized lures aimed at partners and third parties.
Greatness is far from the only PhaaS kit to add device code phishing. In recent months, campaigns have combined Tycoon 2FA kit tradecraft with OAuth device code authorization flows despite a global law enforcement operation that disrupted 330 domains associated with the phishing service.
“The device code phishing pages employ CAPTCHAs and use multi-hop redirect chains through legitimate infrastructure providers before the actual phishing page is shown,” Okta said back in May 2026. “Recent device code phishing pages also employ similar anti-analysis techniques as Tycoon to attempt to deflect analysis.”
Device code phishing attacks can be prevented by blocking the authentication method at a global level in Conditional Access Policies. It’s also advised to move to phishing-resistant MFA methods and teach employees to distrust unexpected codes.
“If this flow is required in very specific use cases, those users/resources should be explicitly excluded from the policies,” LevelBlue noted. “The permitted usage of this flow shall be continuously audited and revoked as soon as it’s no longer necessary.”
