[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8xd753cpmWV0GWONcHRe2x6dmGlmQYEkZ7WyZiRMfUM":3},{"article":4,"iocs":54,"watch_terms":65,"solutions":66,"lesson":155},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"817b4a9c-36d5-4ca3-b077-fc5786d18c0f","Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens","greatness-phaas-adds-device-code-phishing-to-bypass-mfa-and-steal-tokens-bc208a","The commercial phishing-as-a-service (PhaaS) toolkit known as Greatness has become the latest crimeware solution to add support for device code phishing, a rapidly growing cyber threat that abuses the legitimate OAuth 2.0 Device Authorization Grant to bypass Multi-Factor Authentication (MFA) and seize control of user accounts. \"Greatness supports AiTM [adversary-in-the-middle] credential and","The Greatness phishing-as-a-service (PhaaS) toolkit has updated to include device code phishing, a technique that exploits the OAuth 2.0 Device Authorization Grant to bypass MFA and steal user tokens. This expansion allows Greatness to offer adversary-in-the-middle (AiTM) credential and token theft, device code phishing, and OAuth consent abuse from a single platform, targeting services like iCloud, Yahoo, and Google Workspace.","Greatness PhaaS adds device code phishing to bypass MFA and steal tokens.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fgreatness-phaas-adds-device-code.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEi8YRyOCSodUbPpWMicgOiuGbEQWDBmu_W-47PAUFkS7yKEQe4Do6svH4cQb-U0tC53C9mqq8ijjlG9gwuzyqYfNwtS61WxvNxIgk1dVC7wX598rncb_MgQ5t4yxc8NUYVdb6PT5cu7ZXJ7w3KaYG_7vtU5xixHel1jSADbtR-GC1bmngZPArXw-NjkTH1x\u002Fs1600\u002FGreatness.jpg","2026-08-04T17:27:39+00:00","2026-08-04T18:00:23.046775+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Greatness","product",{"name":21,"type":22},"Phishing-as-a-Service (PhaaS)","technology",{"name":24,"type":22},"OAuth 2.0 Device Authorization Grant",{"name":26,"type":22},"Multi-Factor Authentication (MFA)",{"name":28,"type":22},"Adversary-in-the-Middle (AiTM)",{"name":30,"type":19},"Microsoft 365","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":53},{"id":31,"icon":33,"name":34,"slug":35},[55,59,62],{"type":56,"value":57,"context":58},"url","https:\u002F\u002Ft.me\u002FGreatnessPage","Public-facing Telegram channel for Greatness PhaaS.",{"type":56,"value":60,"context":61},"https:\u002F\u002Ft.me\u002Fgr8managerbot","Telegram bot for operator registration, license provisioning, and support.",{"type":56,"value":63,"context":64},"https:\u002F\u002Ft.me\u002Fgreatnessmgr","Telegram handle for developer support and platform development.",[18,30],{"controls":67,"vendors":151},[68,97,126],{"slug":69,"name":70,"problem":71,"products":72},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":98,"name":99,"problem":100,"products":101},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[102,110,118],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"slug":127,"name":128,"problem":129,"products":130},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[131,138,145],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":127,"product_name":135,"url":136,"description":137},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":139,"product_name":142,"url":143,"description":144},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":146,"product_name":147,"url":149,"description":150},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[152],{"slug":74,"name":75,"logo_path":76,"roles":153},[154],"reported_by",{"slug":156,"title":157,"body":158,"framework_refs":159,"framework_notes":172},"phaas-toolkit-bypasses-mfa-via-device-code-phishing-and-token-theft","PhaaS Toolkit Bypasses MFA via Device Code Phishing and Token Theft","The Greatness PhaaS platform has evolved to exploit the OAuth 2.0 Device Authorization Grant flow, allowing attackers to bypass multi-factor authentication entirely by stealing session tokens rather than credentials. This matters because traditional MFA — often considered a gold-standard defense — provides no protection when the authentication flow itself is hijacked through device code phishing. Victims are tricked into authorizing attacker-controlled devices, granting persistent access without ever surrendering a password. The consolidation of AiTM, device code phishing, and OAuth abuse into a single commoditized toolkit dramatically lowers the barrier for cybercriminals to launch sophisticated identity attacks at scale.",[160,161,162,163,164,165,166,167,168,169,170,171],"NIST SP 800-63B (Phishing-Resistant AAL3 Authenticators)","NIST AC-17 (Remote Access)","NIST AC-20 (Use of External Systems)","NIST SI-4 (System Monitoring)","CIS Control 4 (Secure Configuration of Enterprise Assets)","CIS Control 6 (Access Control Management)","CIS Control 12 (Network Infrastructure Management)","CIS Control 16 (Application Software Security)","MITRE ATT&CK T1528 (Steal Application Access Token)","MITRE ATT&CK T1566 (Phishing)","GDPR Article 32 (Security of Processing)","NIST Zero Trust Architecture SP 800-207",{}]