1. Executive summary
The commercial phishing-as-a-service (PhaaS) toolkit Greatness has added device code phishing capabilities, abusing the legitimate OAuth 2.0 Device Authorization Grant to bypass MFA and steal access tokens. The platform now integrates adversary-in-the-middle (AiTM) token theft, device code phishing, and OAuth consent abuse from a single operator panel, targeting Microsoft 365, iCloud, Yahoo, and Google Workspace users. Greatness is subscription-based (from $289/month) with over 3,250 Telegram subscribers, lowering the barrier to entry for credential theft campaigns against EMEA financial services organisations that rely on MFA-protected cloud identities. No verified CVE data, CVSS scores, or CISA-KEV exploitation states are associated with this item — it is a threat-actor capability update, not a software vulnerability.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 18: classification of ICT-related incidents and cyber threats | Greatness device code phishing is a specific cyber threat technique capable of producing major ICT-related incidents (account takeover via stolen tokens) that financial entities must classify. | Clients must ensure their incident classification taxonomy and process can categorise token-theft-driven account compromise as a distinct threat class for DORA reporting readiness. |
| DORA Art. 17: ICT-related incident management process | Successful device code phishing results in stolen OAuth tokens that bypass MFA, requiring a detection-and-response process distinct from traditional credential-stuffing or password-spray playbooks. | Incident management playbooks must include token revocation and conditional-access re-evaluation as containment steps, not just password resets. |
3. Technical analysis & attack chain
Greatness is a PhaaS platform first publicly documented by Cisco Talos in May 2023, with active targeting of Microsoft 365 business users since at least mid-2022. The following attack chain is reconstructed from the ZeroBEC report as reported by The Hacker News. Attribution of the platform to a named threat actor is unconfirmed — no MITRE ATT&CK actor profile is available in the verified reference data.
Attack chain
- Operator provisioning. An attacker purchases a Greatness subscription via Telegram (@GreatnessPage channel, 3,250+ subscribers; @gr8managerbot for registration; @greatnessmgr for licensing). Subscription cost starts at $289/month. The operator provides their Telegram chat ID and a bot API token. Upon successful registration, the operator receives a user ID, a 9-character license key, and a dedicated domain in the format
api-[token].[base-domain]. - Campaign configuration. The operator accesses the "O365 Panel" login page, then a dashboard offering campaign statistics (captured cookies, victim heat map), phishing domain selection, CAPTCHA type selection, background theme, and cookie-saving method configuration.
- Lure selection. The operator downloads one of 11+ pre-built phishing lure templates packaged as ZIP files. Observed template names include: AudioLogin, ChatAssistance, WindowsExplorer, Voicemail, OneDrive, QR, VideoPlayer. Each template contains pre-built HTML, PDF redirectors, SVGs, and letter templates.
- Phishing delivery. The lure is sent to the target. The platform supports multiple attack methods from the same backend: - AiTM credential and token theft — traditional adversary-in-the-middle proxy that intercepts credentials and session tokens. - Device code phishing — abuses the OAuth 2.0 Device Authorization Grant (RFC 8628), designed for input-constrained devices. The victim is tricked into entering a device code at the legitimate Microsoft/Google/Apple login page, authorising the attacker's device session. This bypasses MFA because the legitimate OAuth flow handles the second factor — the attacker receives the resulting access token. - OAuth consent abuse — tricks the victim into granting OAuth application permissions to attacker-controlled apps.
- Token capture and storage. Stolen cookies and tokens are stored in the operator dashboard. Greatness claims stolen cookies are protected via one-way hash and can only be extracted by the subscribing operator using their Telegram account 2FA code.
- Account access. The attacker uses stolen tokens/cookies to access the victim's Microsoft 365, iCloud, Yahoo, or Google Workspace account without requiring MFA.
Confidence caveat: The technical details above are single-sourced — they derive from a ZeroBEC report shared exclusively with The Hacker News. No independent corroboration of the specific panel features, domain format, or template names is available in the provided sources. Verify before enforcement.
4. Mitigation & containment
P1 — within 24 hours
- Block device code flow where not required. In Microsoft Entra ID (Azure AD), disable or conditionally restrict the device code flow for users who do not need it. Conditional Access policy: grant condition requiring "compliant device" or "hybrid Azure AD joined" blocks token use from attacker-controlled devices.
- Review Entra ID sign-in logs for
authenticationProtocol: deviceCodeevents originating from unfamiliar IPs or device IDs. Investigate any device code sign-ins correlated with recent phishing reports from users. - Revoke tokens for any compromised accounts using
Revoke-AzureADUserAllRefreshToken(Azure AD PowerShell) or the Entra admin center. Token revocation is the primary containment — password reset alone is insufficient because stolen tokens remain valid until revoked. - Block known Greatness infrastructure at email gateway and web proxy: domains matching the pattern
api-[token].[base-domain]should be flagged. Note: specific base domains are not provided in the source material — this pattern is a detection heuristic, not an IOC list.
P2 — within 72 hours
- Deploy or update mail-flow rules to quarantine messages containing QR code images or links to external pages presenting QR codes, particularly those mimicking Microsoft 365, OneDrive, or voicemail login pages. Greatness templates explicitly include QR and Voicemail lures.
- Review OAuth application grants in Entra ID and Google Workspace admin console. Revoke any applications with suspicious consent scopes (Mail.Read, Files.Read, User.Read.All) that users did not intentionally authorise. This addresses the OAuth consent abuse vector.
- User awareness briefing — alert staff to device code phishing: the legitimate Microsoft device code page is at
microsoft.com/devicelogin. Any unsolicited prompt to visit this page or enter a code is suspicious.
P3 — within 7 days
- Enforce Conditional Access policies requiring token protection (Entra ID) or session controls that bind tokens to compliant devices, limiting replay value of stolen tokens.
- Audit MFA registration — ensure all privileged accounts have phishing-resistant MFA (FIDO2 hardware keys) rather than push notifications or OTP, which are vulnerable to AiTM relay.
- Review DORA Art. 17 incident playbooks to include device code phishing as a distinct incident type with token revocation as the primary containment action.
5. Indicators of compromise
No atomic indicators (IPs, domains, hashes, URLs) are provided in the source material. The following behavioural indicators are derived from the described platform capabilities.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
Device code authentication flow (deviceCode sign-in) from unfamiliar IP or device |
Entra ID / Azure AD sign-in logs, filtered by authenticationProtocol == deviceCode |
High — inherent to the attack technique |
| New OAuth app consent grants from users shortly after receiving suspicious email | Entra ID audit logs (OAuth consent grant events); Google Workspace admin audit log | High — Greatness supports OAuth consent abuse |
| Inbound email containing QR code images or links to pages mimicking Microsoft 365 / OneDrive / voicemail login | Email gateway / mail-flow logs | Medium — matches Greatness lure templates (QR, Voicemail, OneDrive) |
DNS queries or HTTP connections to domains matching pattern api-[token].[base-domain] |
DNS logs, web proxy logs, EDR network telemetry | Medium — pattern derived from source; no specific domains provided |
User reports of being asked to visit microsoft.com/devicelogin and enter a code received via email |
Helpdesk / SOC ticketing system | High — core device code phishing mechanic |
6. Detection
rule Greatness_Phaas_Lure_Templates {
meta:
author = "Adverse Trace"
date = "2026-08-05"
reference = "https://thehackernews.com/2026/08/greatness-phaas-adds-device-code.html"
description = "Detects Greatness PhaaS lure template package artefacts based on template names and packaging"
strings:
$template1 = "AudioLogin" nocase
$template2 = "ChatAssistance" nocase
$template3 = "WindowsExplorer" nocase
$template4 = "Voicemail" nocase
$template5 = "VideoPlayer" nocase
$panel = "O365 Panel" nocase
$license = "license key" nocase
condition:
3 of ($template*) or ($panel and $license)
}
title: Device Code Authentication Flow from Unfamiliar Location
id: 7a3c1f2e-8b5d-4a6e-9c0f-1d2e3f4a5b6c
status: experimental
description: Detects device code grant sign-ins (OAuth 2.0 Device Authorization Grant) that may indicate Greatness device code phishing or similar token theft
author: Adverse Trace
date: 2026/08/05
references:
- https://thehackernews.com/2026/08/greatness-phaas-adds-device-code.html
logsource:
product: azure
service: signinlogs
detection:
selection:
authenticationProtocol: deviceCode
resultType: 0
filter_known_devices:
deviceDetail.trustType:
- "Domain Joined"
- "Compliant"
condition: selection and not filter_known_devices
falsepositives:
- Legitimate device code authentication from input-constrained devices (printers, smart TVs, CLI tools)
- Developer authentication via Azure CLI or similar tools
level: medium
7. Sources
- The Hacker News, "Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens," https://thehackernews.com/2026/08/greatness-phaas-adds-device-code.html, 2026-08-04
- The Hacker News, "6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026," https://thehackernews.com/2026/07/6-reasons-why-device-code-phishing-is.html, 2026-07
- Huntress, "We Need to Talk About Device Code Phishing," https://www.huntress.com/blog/tradecraft-tuesday-device-code-phishing-explained, 2026 (accessed 2026-08-05)
8. Adverse Trace position
Greatness's addition of device code phishing to an already capable AiTM and OAuth abuse platform represents a meaningful escalation for EMEA financial services. The technique bypasses MFA — the primary control most institutions rely on for cloud identity protection — by abusing a legitimate OAuth flow, making it difficult to block without conditional access policies that bind tokens to compliant devices. The platform's low cost ($289/month), pre-built lure templates, and multi-platform targeting (Microsoft 365, Google Workspace, iCloud, Yahoo) lower the barrier for opportunistic and targeted campaigns alike. Severity is assessed as high for organisations relying on MFA without phishing-resistant factors or token protection. Attribution to a named actor is unconfirmed — no MITRE profile exists in the verified reference data. The technical details are single-sourced (ZeroBEC via The Hacker News); we will update this advisory if independent corroboration or specific IOCs become available. Clients should prioritise P1 actions immediately: restrict device code flows, review sign-in logs, and ensure token revocation is in their incident response playbook.
Published via PulseTrace — Adverse Trace threat intelligence.