Greatness PhaaS Adds Device Code Phishing to Bypass MFA and…

The Greatness phishing-as-a-service toolkit has integrated device code phishing, abusing the OAuth 2.0 Device Authorization Grant to bypass multi-factor authentication and steal access and refresh tokens. Documented by Cisco Talos in May 2023 with attacks against Microsoft 365 users dating to mid-2022, the platform has evolved from simple credential harvesting into an integrated ecosystem managing AiTM proxy, device code phishing, and OAuth consent abuse from a single operator panel. The evolution, reported August 4, 2026 by ZeroBEC research published on The Hacker News, confirms the industrialization of once-manual techniques into a SaaS-priced platform with Telegram support.

August 16, 2026

The Greatness phishing-as-a-service toolkit has integrated device code phishing, abusing the OAuth 2.0 Device Authorization Grant to bypass multi-factor authentication and steal access and refresh tokens. The platform, publicly documented by Cisco Talos in May 2023 with attacks against Microsoft 365 users from mid-2022, has evolved its offering from simple credential harvesting into an integrated ecosystem that manages AiTM proxy, device code phishing, and OAuth consent abuse from the same operator panel. The evolution, reported August 4, 2026 by ZeroBEC research published on The Hacker News, confirms the industrialization of once-manual techniques into platforms with software-as-a-service pricing and Telegram support.

Key Takeaways

Greatness manages three attack vectors from a unified panel: AiTM credential and token theft, device code phishing, and OAuth consent abuse, with a shared backend.
Device code phishing abuses the OAuth 2.0 Device Authorization Grant flow (RFC 8628): the victim authenticates on legitimate Microsoft or Google servers, completing MFA, while the attacker-controlled device receives the tokens and refresh tokens.
Subscription starts at $289 per month, up from $120 per month reported in January 2024, with registration and support via Telegram bot @gr8managerbot.
Stolen tokens are replayed within minutes from dedicated proxy infrastructure, with active logins sustained for over two weeks and new device registrations to generate Primary Refresh Tokens within minutes of compromise.

How Greatness Device Code Phishing Works

The mechanism exploits a legitimate function designed for devices with limited or no keyboard. The attacker initiates the OAuth 2.0 Device Authorization Grant flow on a device under their control, obtaining a user_code and a verification_uri. These elements are delivered to the victim through phishing lures — email, SMS, or voicemail — that present a short code and a plausible reason to enter it.

The victim, on a separate device, accesses the real verification_uri — microsoft.com or google.com — enters the code, authenticates with their own credentials, completes any MFA, and confirms consent. The attacker's original device receives the access_token and refresh_token. Because the interaction occurs entirely on authentic infrastructure, no traditional visual phishing indicators exist: no fake page to analyze, no suspicious URL to detect.

According to ZeroBEC, "there is no fake login site to build or get blocked, and there is nothing visually wrong that the user can notice, because the page where they enter their password is really Microsoft. The only unusual thing is a short code and a plausible reason to enter it."

Industrialization of the Operator Panel

The Greatness platform integrates three attack vectors with a shared backend into the same operator panel: AiTM credential and token theft, device code phishing, and OAuth consent abuse. Support extends to multiple targets: Microsoft 365, Google Workspace, iCloud, and Yahoo. The panel includes campaign statistics, domain configuration, CAPTCHA selection, and over 11 downloadable templates covering voicemail, document sharing, and QR codes.

Observed templates include: AudioLogin, ChatAssistance, WindowsExplorer, Voicemail, OneDrive, QR, and VideoPlayer. Panel access requires a 9-character license key. Registration and technical support occur exclusively via Telegram bots: @gr8managerbot for support, @greatnessmgr for license management.

The redirect chain preceding the final phishing stage is structured in 5 stages, with anti-analysis protections, User-Agent fingerprinting, and CAPTCHA gates. Recent campaigns use voicemail lures impersonating RingCentral, exploiting safe sender exclusions configuration — present because the target is a genuine RingCentral customer — even when SPF, DKIM, and DMARC checks fail.

Post-Compromise Timeline and Persistence

Tokens collected through device code phishing do not sit idle. ZeroBEC documents that they are replayed within minutes from dedicated proxy infrastructure, with enumeration of Microsoft 365 resources via Graph API. An AiTM proxy IP address, 38.248.95[.]214, continued authenticating against victim accounts for over two weeks after the initial campaign.

Microsoft has observed persistence patterns following a specific timeline: registration of new devices within minutes of compromise to generate Primary Refresh Tokens, followed by a wait of several hours before setting malicious inbox rules or exfiltrating data. This latency reduces the risk of immediate detection by monitoring systems based on activity spikes.

Okta, in a May 2026 report, confirmed that device code phishing pages employ CAPTCHA and multi-hop redirect chains with anti-analysis techniques similar to those documented for Tycoon 2FA. The technical overlap is evident; no infrastructure overlaps linking Greatness to Tycoon emerge in the dossier at this time.

What to Do Now

Defenses against device code phishing require specific interventions on OAuth flows, not just generic awareness. LevelBlue, cited in the ZeroBEC research, recommends blocking the OAuth device flow method globally in Microsoft Entra ID Conditional Access Policies, excluding only documented use cases such as corporate IoT devices or smart TVs.

Administrators should verify that Conditional Access policies require device compliance or trusted location for device code authentication flows as well, not just for traditional browser logins. Monitoring must alert on new device registrations within minutes of compromise, when attackers generate Primary Refresh Tokens for extended persistence.

Organizations that are RingCentral customers should treat vendor breaches as an immediate trigger to audit email exclusion rules: ZeroBEC research highlights that attackers exploit the fact that targets are genuine customers of the impersonated service, resulting in the domain's presence in safe sender lists.

Why This Matters

The dossier does not specify corrective measures released by Microsoft or other vendors beyond generic Conditional Access recommendations. The brief does not document whether Greatness has already adapted its toolkit to such countermeasures.

The dossier does not specify the exact number of active operators or victims of the platform, nor the preferred geography or most affected sectors. It is unclear whether the $289 per month price applies to all subscription tiers or only the base tier. It is not confirmed whether Greatness is developed by the same team behind Tycoon 2FA or simply replicates techniques observed in that platform.

The critical aspect remains the shift in the defensive perimeter: traditional training campaigns on recognizing suspicious URLs and fake pages become ineffective when the victim interacts with authentic Microsoft or Google domains. As Mani Masood notes, "the user approves a real request, but does not understand who created it or why it appeared. MFA confirms the person at the keyboard. It does not always confirm the person who initiated the login."

The shift from specialized toolkits to integrated platforms with economies of scale lowers the barrier to entry for less technical criminals, accelerating the spread of techniques that previously required manual expertise. Telegram support and monthly pricing structure a repeatable business model, not dependent on selling zero-day exploits or single accesses.

"Greatness supports AiTM credential and token theft, device code phishing, and OAuth consent abuse, all from the same operator panel and shared backend infrastructure" — ZeroBEC (via The Hacker News)

Information is based on the cited advisory and current as of publication.

Sources

Sources and references