Greatness PhaaS now supports device code phishing, a sneaky attack that bypasses MFA by tricking you into authorizing the attacker's device. Learn how it works and how to protect yourself.
The commercial phishing-as-a-service (PhaaS) toolkit known as Greatness has just gotten a lot more dangerous. It's now the latest crimeware solution to add support for device code phishing, a rapidly growing cyber threat that abuses the legitimate OAuth 2.0 Device Authorization Grant. The goal? Bypass Multi-Factor Authentication (MFA) and seize control of user accounts.
If you've been relying on MFA as your safety net, this news should grab your attention. Attackers aren't breaking in through the front door anymore. They're using a trick that turns a standard login flow against you, and it's scarily effective.
### What Is Device Code Phishing, Exactly?
Device code phishing isn't some exotic new hack. It's an abuse of a feature designed for devices that can't easily type in credentials, like smart TVs, gaming consoles, or command-line tools. Instead of entering a username and password directly, the device shows you a code. You then go to a separate page, enter that code, and log in to authorize the device.
Here's the twist: attackers set up a fake login page that mimics a legitimate service. They lure you there, you enter your credentials, and then they prompt you for a device code. When you enter that code on the real service's page, you're actually authorizing the attacker's device. You've just handed over your session token without even realizing it.
### Why This Bypasses Your MFA
MFA works by requiring something you know (your password) and something you have (like a code from an authenticator app). In a typical phishing attack, the attacker steals your password but can't get past the second factor. But with device code phishing, you're the one entering the code. You're essentially logging in for the attacker.
- The attacker doesn't need your MFA code because you're providing it.
- The session token is created on the attacker's device, not yours.
- Even if you change your password later, the stolen session remains valid.
### The Greatness Toolkit Gets an Upgrade
Greatness is a commercial PhaaS platform that's been around for a while, offering cybercriminals an easy way to launch phishing campaigns. It's now added device code phishing to its arsenal, which means even low-skilled attackers can use this technique.
"Greatness supports AiTM [adversary-in-the-middle] credential and session theft," the toolkit's marketing materials boast. That's a direct admission that it's built to steal more than just passwords. It's after your entire authenticated session.
### What This Means for You
If you're a security professional or just someone who cares about their digital privacy, this is a wake-up call. MFA is still better than nothing, but it's not the silver bullet we once thought it was. Here's what you should do:
- Be extremely cautious about entering device codes on any page you didn't navigate to directly.
- Always verify the URL of the page asking for your login credentials.
- Use phishing-resistant MFA methods, like hardware security keys, whenever possible.
- Monitor your account activity for unexpected sessions or devices.
### The Bigger Picture
Device code phishing is part of a broader trend where attackers are moving away from brute-force attacks and toward social engineering. They're not trying to break your security; they're trying to trick you into opening the door for them. The Greatness toolkit's adoption of this technique means we'll likely see a spike in these attacks.
It's a constant game of cat and mouse. Security tools evolve, and so do the attackers. The best defense is a combination of technology and awareness. Stay informed, stay skeptical, and never assume you're too small a target to be attacked.
