The Greatness Phishing-as-a-Service (PhaaS) platform has evolved with a dangerous new capability: device code phishing attacks that bypass multi-factor authentication (MFA). This technique exploits OAuth 2.0’s device authorization flow to trick victims into authenticating malicious applications, granting attackers access to Microsoft 365 accounts even when protected by MFA. The updated toolkit represents a significant escalation in credential theft sophistication, targeting enterprise environments with advanced social engineering tactics and token harvesting capabilities.
Introduction
Multi-factor authentication has long been considered a reliable defense against credential theft, but threat actors continue to develop innovative methods to circumvent these protections. Greatness, a prominent PhaaS operation first documented in mid-2022, has now integrated device code phishing into its arsenal—a technique that manipulates legitimate OAuth flows to steal authentication tokens.
This development marks a concerning evolution in the PhaaS landscape. Unlike traditional phishing that captures usernames and passwords, device code phishing exploits the trust relationship between users and legitimate authentication systems. By leveraging Microsoft’s own device authorization mechanism, attackers can obtain persistent access tokens that bypass MFA entirely, making detection significantly more challenging for security teams.
The integration of this technique into a turnkey PhaaS platform lowers the barrier to entry for cybercriminals, enabling even less technically sophisticated actors to launch sophisticated MFA bypass campaigns at scale.
Background & Context
Greatness emerged in 2022 as a comprehensive PhaaS solution offered through Telegram channels, providing affiliates with ready-made phishing kits, hosting infrastructure, and attachment templates. The service primarily targets Microsoft 365 users through convincing fake login pages that mimic legitimate Microsoft authentication interfaces.
Device code phishing, also known as device code authentication flow abuse, exploits a legitimate OAuth 2.0 feature designed for devices with limited input capabilities—such as smart TVs or IoT devices. The standard device code flow works as follows:
- A device requests authorization and receives a device code and user code
- The user visits a verification URL on a secondary device
- The user enters the code and authenticates
- The original device polls for approval and receives access tokens
Attackers manipulate this flow by initiating the authentication request themselves, then tricking victims into completing the approval process. Once approved, attackers receive valid OAuth tokens with the victim’s privileges, granting access to email, files, and other Microsoft 365 resources without needing the original password or MFA codes.
This technique gained prominence in 2023 when multiple threat groups began incorporating it into campaigns, but its integration into Greatness represents the first widespread commercialization through a PhaaS platform.
Technical Breakdown
The Greatness device code phishing attack chain follows a sophisticated multi-stage process:
Initial Compromise Vector
Attackers distribute phishing emails with malicious HTML attachments or links. These emails often impersonate SharePoint notifications, OneDrive sharing alerts, or voicemail messages—scenarios that create urgency and encourage immediate action.
Device Code Generation
When a victim opens the malicious attachment, the embedded JavaScript automatically initiates an OAuth device code request to Microsoft’s legitimate endpoints:
POST https://login.microsoftonline.com/organizations/oauth2/v2.0/devicecode
Content-Type: application/x-www-form-urlencoded
client_id=&scope=https://graph.microsoft.com/.default
Microsoft responds with a device code, user code, and verification URL—typically https://microsoft.com/devicelogin.
Social Engineering Layer
The phishing page displays a convincing Microsoft-branded interface instructing the victim to:
- Visit microsoft.com/devicelogin (a legitimate Microsoft URL)
- Enter the provided code
- Authenticate using their credentials and MFA
Because victims interact directly with genuine Microsoft infrastructure, security awareness training often fails to prevent successful attacks. The legitimate domain and valid SSL certificate bypass many security controls.
Token Harvesting
While the victim completes authentication, the attacker’s backend continuously polls Microsoft’s token endpoint:
POST https://login.microsoftonline.com/organizations/oauth2/v2.0/token
Content-Type: application/x-www-form-urlencoded
client_id=&device_code=&grant_type=urn:ietf:params:oauth:grant-type:device_code
Upon successful authentication, the attacker receives OAuth access and refresh tokens with permissions matching the compromised user's privileges. These tokens remain valid for extended periods—typically 90 days for refresh tokens—providing persistent access.
Post-Exploitation Activities
Greatness operators then leverage compromised accounts for business email compromise (BEC), lateral movement, data exfiltration, or selling access to other threat actors. The platform includes built-in capabilities for automated mailbox harvesting and contact scraping to facilitate follow-on attacks.
Impact & Risk Assessment
The integration of device code phishing into Greatness creates significant risks across multiple dimensions:
Enterprise Environment Exposure
Organizations relying solely on MFA for account protection face a false sense of security. Device code phishing renders traditional MFA implementations ineffective, as victims willingly approve malicious authentication requests through legitimate channels.
Scale and Accessibility
PhaaS platforms democratize advanced attack techniques. Greatness's user-friendly interface and subscription model enable affiliates with minimal technical skills to execute sophisticated campaigns, dramatically increasing the threat volume.
Detection Challenges
Because authentication occurs through legitimate Microsoft infrastructure, traditional phishing indicators fail. Email security gateways cannot flag microsoft.com as malicious, and users see valid SSL certificates throughout the process.
Financial and Operational Consequences
Successful compromises lead to:
- Business email compromise with average losses exceeding $50,000 per incident
- Data breaches exposing sensitive corporate and customer information
- Regulatory penalties under GDPR, HIPAA, or other compliance frameworks
- Operational disruption during incident response and recovery
- Reputational damage affecting customer trust and business relationships
Organizations in financial services, healthcare, legal, and professional services sectors face particularly acute risks due to the sensitive nature of data in compromised Microsoft 365 environments.
Vendor Response
Microsoft has acknowledged the abuse of device code flows and implemented several mitigations within Azure Active Directory (now Microsoft Entra ID):
Conditional Access Policies
Administrators can configure policies to block device code flow authentication for specific users, groups, or applications. Microsoft recommends restricting this flow to explicitly approved scenarios.
Application Governance
Microsoft Defender for Cloud Apps now includes detection rules for suspicious OAuth application consent activity, alerting security teams to unusual device code authentications.
Enhanced Logging
Azure AD sign-in logs now provide better visibility into device code flow authentications, including:
- Authentication method used
- Application requesting access
- IP addresses and geolocation data
- Success/failure status
Microsoft's security blog published guidance in early 2023 addressing device code phishing, though the technique continues to evolve faster than defensive implementations.
The company emphasizes that device code flow serves legitimate business purposes and cannot be entirely disabled globally without affecting valid use cases, placing responsibility on organizations to implement appropriate controls.
Mitigations & Workarounds
Organizations should implement multiple defensive layers to protect against Greatness device code phishing:
Disable Device Code Flow
For environments without legitimate device code requirements, administrators should disable this authentication flow entirely:
# Connect to Microsoft Graph
Connect-MgGraph -Scopes "Policy.ReadWrite.AuthenticationFlows"
# Disable device code flow
$params = @{
DeviceCodeFlowConfiguration = @{
IsEnabled = $false
}
}
Update-MgPolicyAuthenticationFlowPolicy -BodyParameter $params
Implement Conditional Access Restrictions
Create policies that limit device code authentication to specific trusted locations or compliant devices:
Azure AD > Security > Conditional Access > New Policy
- Users: All users
- Cloud apps: All cloud apps
- Conditions: Authentication flows > Device code flow
- Grant: Block or Require compliant device
Deploy Phishing-Resistant MFA
Transition to FIDO2 security keys, Windows Hello for Business, or certificate-based authentication—methods resistant to device code phishing attacks.
Email Security Controls
Configure advanced threat protection to flag HTML attachments and suspicious redirect chains, even when pointing to legitimate domains.
User Education
Train employees to recognize device code phishing characteristics:
- Unexpected requests to visit devicelogin URLs
- Authentication prompts without user-initiated action
- Vague or urgent messaging in emails
Detection & Monitoring
Security teams should implement monitoring for device code authentication abuse:
Azure AD Sign-In Log Queries
Monitor for device code flow authentications using KQL queries:
SigninLogs
| where AuthenticationProtocol == "deviceCode"
| where ResultType == 0
| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, LocationDetails
| order by TimeGenerated descBehavioral Analytics
Establish baselines for device code usage and alert on anomalies:
- First-time device code authentication for users
- Device code authentications outside business hours
- Multiple device code requests in short timeframes
- Authentications from unfamiliar geographical locations
OAuth Application Auditing
Regularly review OAuth consent grants and application permissions:
Get-MgUserOauth2PermissionGrant -UserId |
Select-Object ClientId, Scope, ConsentType, PrincipalId Indicators of Compromise
Monitor for post-compromise activities:
- Unusual mailbox rule creation
- Mass email forwarding configurations
- Abnormal login patterns following device code authentication
- Data exfiltration to external services
Integrate these detections with SIEM platforms to correlate device code authentication events with broader attack patterns.
Best Practices
Comprehensive protection requires a defense-in-depth approach:
Authentication Security
- Implement phishing-resistant MFA organization-wide
- Disable legacy authentication protocols
- Enforce conditional access policies based on risk signals
- Regularly audit authentication methods and service principal permissions
Email Defense
- Deploy advanced anti-phishing solutions with machine learning capabilities
- Implement DMARC, SPF, and DKIM to prevent domain spoofing
- Use email attachment sandboxing for suspicious files
- Enable safe links and safe attachments features
Identity Governance
- Apply least privilege principles to user and service accounts
- Conduct regular access reviews and permission audits
- Implement privileged access workstations for administrative activities
- Use separate accounts for administrative versus standard tasks
Security Awareness
- Conduct regular phishing simulations including device code scenarios
- Establish clear reporting procedures for suspicious authentication requests
- Create security champions programs to reinforce best practices
- Provide role-specific training for high-value targets
Incident Response Preparation
- Develop playbooks specifically addressing OAuth token compromise
- Establish procedures for rapid token revocation
- Maintain offline access to critical authentication systems
- Conduct tabletop exercises simulating PhaaS attacks
Key Takeaways
- Greatness PhaaS now includes device code phishing capabilities that bypass traditional MFA protections by exploiting legitimate OAuth flows
- The technique manipulates users into authenticating malicious requests through genuine Microsoft infrastructure, making detection extremely difficult
- Device code phishing grants attackers OAuth tokens with persistent access to Microsoft 365 environments without requiring passwords or MFA codes
- Organizations must implement phishing-resistant MFA, conditional access policies, and comprehensive monitoring to defend against this threat
- The commercialization of advanced techniques through PhaaS platforms significantly lowers the skill barrier for attackers, increasing overall threat volume
- Defense requires multiple layers including authentication security, email filtering, user education, and behavioral analytics
- Disabling device code flow entirely provides the strongest protection for environments without legitimate business requirements for this authentication method
References
- Microsoft Identity Platform Device Authorization Grant Flow Documentation
- Azure Active Directory Conditional Access Policy Configuration Guides
- Microsoft Security Blog: Device Code Phishing Threat Analysis
- MITRE ATT&CK Technique T1566 (Phishing) and T1528 (Steal Application Access Token)
- CISA Alert: Phishing-as-a-Service Operations
- Greatness PhaaS Threat Intelligence Reports from Leading Security Vendors
Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/
