Greatness Phishing-as-a-Service Device Code Phishing / MFA Bypass

Technical Analysis

Greatness abuses the OAuth 2.0 Device Authorization Grant, a flow designed for input-constrained devices, by tricking victims into entering an attacker-generated device code on a legitimate identity provider login page (e.g., Microsoft 365), which then issues a valid access/refresh token to the attacker rather than the victim's intended device. This bypasses MFA entirely since the authentication ceremony completes legitimately from the victim's perspective, and it complements Greatness's existing AiTM reverse-proxy phishing kit that harvests session cookies and credentials in real time. No software vulnerability or CVE is involved; the attack exploits protocol trust assumptions and social engineering rather than a code flaw. Stolen OAuth tokens and session cookies can grant persistent access to cloud mailboxes, SSO-connected SaaS apps, and API-driven integrations without triggering re-authentication. Organizations running AI agents or LLM tool-use pipelines that authenticate via OAuth/device-code flows to access cloud identity providers, email, or SaaS APIs are directly at risk, as stolen tokens could grant attackers the same delegated permissions used by autonomous agents to read data, send communications, or invoke connected tools, enabling silent lateral movement through agent-integrated systems.

Affected Systems

Organizations using OAuth 2.0 Device Authorization Grant flows (e.g., Microsoft 365/Entra ID, Google Workspace, and other SSO/identity providers supporting device code login); users and service accounts, including AI agent/automation identities, authenticated via device-code or delegated OAuth token flows without additional phishing-resistant MFA (e.g., FIDO2/WebAuthn).

Indicators of Compromise

• Domain patterns mimicking Microsoft/O365 login portals used by Greatness PhaaS phishing kits
• AiTM reverse-proxy phishing infrastructure associated with Greatness PhaaS
• Unusual OAuth device code authorization requests originating from atypical geographies/IPs
• Rapid token issuance followed by mailbox rule creation or mass data exfiltration activity

Remediation Steps

1. 1

   Disable or restrict device code flow

   Where not operationally required, disable the OAuth Device Authorization Grant flow in your identity provider (e.g., Conditional Access policies in Entra ID) or restrict it to trusted networks/devices.

2. 2

   Enforce phishing-resistant MFA

   Move users, admins, and especially service/agent accounts to FIDO2/WebAuthn or certificate-based authentication, which are not susceptible to AiTM or device-code token theft.

3. 3

   Monitor for anomalous device code sign-ins

   Implement detection rules for device code authentication events, especially those from unfamiliar IPs, ASNs, or geolocations, and correlate with subsequent risky sign-in activity.

4. 4

   Rotate and scope OAuth tokens for automation/agent accounts

   Audit and rotate long-lived OAuth tokens and API keys used by AI agents, RAG pipelines, and automation tools; apply least-privilege scopes and short token lifetimes to limit blast radius if compromised.

5. 5

   User awareness training

   Train users to recognize device code phishing lures and never enter codes provided via unsolicited emails, chat messages, or pop-ups outside expected sign-in workflows.