Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens

The Greatness PhaaS platform has evolved to exploit the OAuth 2.0 Device Authorization Grant flow, allowing attackers to bypass multi-factor authentication entirely by stealing session tokens rather than credentials. This matters because traditional MFA — often considered a gold-standard defense — provides no protection when the authentication flow itself is hijacked through device code phishing. Victims are tricked into authorizing attacker-controlled devices, granting persistent access without ever surrendering a password. The consolidation of AiTM, device code phishing, and OAuth abuse into a single commoditized toolkit dramatically lowers the barrier for cybercriminals to launch sophisticated identity attacks at scale.