The commercial phishing-as-a-service (PhaaS) toolkit known as Greatness has become the latest crimeware solution to add support for device code phishing, a rapidly growing cyber threat that abuses the legitimate OAuth 2.0 Device Authorization Grant to bypass Multi-Factor Authentication (MFA) and seize control of user accounts.
"Greatness supports AiTM [adversary-in-the-middle] credential and token theft, device code phishing, and OAuth consent abuse, all from the same operator panel and shared backend infrastructure," ZeroBEC said in a report shared with The Hacker News detailing the PhaaS kit's latest capabilities.
"The platform now supports AiTM token theft, device code phishing, OAuth consent abuse, and multiple target platforms, including iCloud, Yahoo, and Google Workspace. This evolution reflects the broader trend of PhaaS platforms expanding from simple credential harvesting to integrated attack ecosystems."
The phishing platform was first publicly documented by Cisco Talos in May 2023, highlighting how threat actors are incorporating it in their attacks to target Microsoft 365 business users since at least mid-2022.
Designed as a way to lower the barrier of entry for cybercrime, access to Greatness is facilitated through a subscription available on its public-facing Telegram channel (@GreatnessPage) that has more than 3,250 subscribers and serves as a central hub for announcements and feature updates.
