The Greatness phishing platform now uses adversary-in-the-middle and device-code attacks to bypass MFA and steal Microsoft 365 accounts. Here's how it works and how to defend.
If you've been in the cybersecurity game for a while, you know the drill: phishing emails are annoying, but they're usually easy to spot. Bad grammar, a weird sender address, a sense of urgency that feels off. You delete it, maybe report it, and move on. But what happens when the attackers get smarter? When they stop asking for your password and instead trick you into approving the login yourself?
That's exactly what's happening with the Greatness phishing-as-a-service (PhaaS) platform. It's not your run-of-the-mill credential harvester anymore. It has evolved, and it's now setting its sights on Microsoft 365 accounts with a level of sophistication that should make every IT admin sit up and take notice.
We're not talking about a lone hacker in a basement. This is a commercial operation, a service that other criminals pay to use. And the latest upgrades are designed to bypass the very security measures we've been told to trust.
### The Shift from Simple Credential Theft
For years, the standard phishing attack was straightforward: build a fake login page that looks like the real thing, send out thousands of emails, and hope someone takes the bait. When the victim typed in their username and password, the attacker captured those credentials and sold them or used them directly.
Greatness did that well. But it has moved on. Now, it's deploying two more dangerous techniques: adversary-in-the-middle (AitM) attacks and device-code phishing. Both of these are designed to defeat multi-factor authentication (MFA), which is the security layer that most organizations rely on to keep accounts safe.
### What Is Adversary-in-the-Middle (AitM)?
Think of it this way: you're on a phone call with your bank, and you think you're talking to a representative. But in reality, there's a translator on the line who's listening to both sides and relaying messages. That translator can change what the bank says to you and what you say to the bank.
That's essentially what an AitM attack does. The attacker sits between the user and the legitimate Microsoft 365 login page. You think you're logging in directly, but you're actually sending your credentials to the attacker, who forwards them to Microsoft. When Microsoft sends back a one-time code or a push notification for MFA, you approve it, thinking it's for your own login. But the attacker captures that approval and uses it to hijack your session.
It's a clever trick because it doesn't require the attacker to steal your password. They just need to relay the authentication flow in real-time. The user is none the wiser.
### Device-Code Phishing: The New Frontier
Device-code phishing is a bit different but equally nasty. It exploits a feature designed for devices that don't have a browser, like smart TVs or command-line tools. Microsoft lets you authenticate by entering a short code on another device.
Here's how the attack works: the attacker generates a legitimate device code from Microsoft. They then trick the victim into visiting a fake login page and entering that code. The victim thinks they're just signing in, but the code actually grants the attacker access to the account. The victim sees a legitimate Microsoft prompt asking them to confirm the sign-in, and they click "Yes." Done. The attacker is in.
### Why This Matters for Your Business
You might be thinking, "Sure, this is bad, but my company has robust security training." That's great, but the reality is that these attacks are designed to bypass the human element. They don't rely on you making a mistake like typing your password into the wrong box. They rely on you trusting the legitimate-looking Microsoft login flow.
- **MFA is not a silver bullet.** It's a strong control, but it can be bypassed.
- **Security awareness training needs to evolve** to include these new attack vectors.
- **Conditional access policies** and device compliance checks become even more critical.
We need to stop thinking of phishing as just a "password stealing" problem. It's a session hijacking problem now. The attacker doesn't need your password if they can steal your authenticated session.
### Practical Steps to Defend Against This
So, what can you do? It's not all doom and gloom. There are concrete steps you can take to significantly reduce your risk.
First, implement phishing-resistant MFA. This means moving away from one-time codes and push notifications and toward hardware security keys, like FIDO2 keys. These keys are cryptographically bound to the specific site you're visiting, so they can't be relayed by an attacker.
Second, scrutinize the URL. In an AitM attack, the URL might look correct at first glance, but there are often subtle differences. Train your users to check for typos, extra characters, or unusual domain extensions.
Third, use conditional access policies in Microsoft Entra ID (formerly Azure AD). You can block sign-ins from untrusted devices, require a compliant device, or flag impossible travel scenarios. These policies add context to the authentication request and can stop an attack even if the credentials and MFA are valid.
### The Bottom Line
The Greatness platform is a reminder that cybercrime is a business, and like any business, it evolves to meet customer demand. The demand here is for a way to bypass MFA, and the suppliers have delivered.
We can't afford to be complacent. The tools we've relied on are no longer sufficient on their own. It's time to layer our defenses, adopt phishing-resistant authentication, and educate our users on the new reality of session hijacking.
The threat is real, and it's happening right now. The only question is whether your organization is ready for it.