PhaaS Toolkit Bypasses MFA via Device Code Phishing and Token Theft
Written by AI from the linked story. Not reviewed by an editor. How this works
The Greatness PhaaS platform has evolved to exploit the OAuth 2.0 Device Authorization Grant flow, allowing attackers to bypass multi-factor authentication entirely by stealing session tokens rather than credentials. This matters because traditional MFA — often considered a gold-standard defense — provides no protection when the authentication flow itself is hijacked through device code phishing. Victims are tricked into authorizing attacker-controlled devices, granting persistent access without ever surrendering a password. The consolidation of AiTM, device code phishing, and OAuth abuse into a single commoditized toolkit dramatically lowers the barrier for cybercriminals to launch sophisticated identity attacks at scale.
Tactical Insight
Immediate actions
- Restrict or disable the OAuth 2.0 Device Authorization Grant flow for users who do not require device-based authentication workflows.
- Enforce Conditional Access policies that block token issuance from unmanaged or unrecognized devices.
- Audit existing OAuth application consents and revoke any suspicious or unknown third-party app authorizations immediately.
Long-term improvements
- Migrate to phishing-resistant MFA methods such as FIDO2/WebAuthn hardware security keys that are immune to token-theft and AiTM attacks.
- Implement a Zero Trust architecture requiring continuous verification of device health, user identity, and session context before granting resource access.
- Establish a formal OAuth application allowlist so only pre-approved apps can request user consent within your environment.
Detection measures
- Monitor identity provider logs for anomalous device code authentication attempts, especially from unfamiliar IP addresses or geographies.
- Alert on unusual OAuth consent grants or new application registrations outside of approved change windows.
- Deploy User and Entity Behavior Analytics (UEBA) to detect impossible travel, token replay, or session anomalies indicative of stolen tokens.