The Greatness phishing-as-a-service (PhaaS) platform has expanded its operational capabilities by integrating device code phishing, according to The Hacker News. This update allows threat actors to exploit the OAuth 2.0 Device Authorization Grant protocol, effectively circumventing Multi-Factor Authentication (MFA) protections to gain unauthorized access to enterprise and consumer accounts.

Greatness has traditionally relied on adversary-in-the-middle (AiTM) techniques to harvest credentials. By adding support for device code phishing, the toolkit now offers a secondary vector to compromise accounts that utilize modern authentication standards. This method typically involves tricking users into entering a short alphanumeric code on a legitimate-looking but attacker-controlled interface, which then provides the attacker with a persistent access token.

Technical Mechanism Overview

This development signifies a shift in how automated phishing kits operate. By integrating these protocols directly into the service architecture, Greatness lowers the barrier to entry for attackers who lack the technical expertise to manually weaponize OAuth 2.0 device flow vulnerabilities.

Why It Matters

The integration of OAuth 2.0 abuse into commercialized phishing kits suggests that standard MFA implementations are no longer sufficient to stop sophisticated automated threats. Organizations relying solely on legacy MFA or simple push notifications are increasingly vulnerable to these token-theft tactics. This transition indicates that PhaaS operators are prioritizing session hijacking over simple credential harvesting, as persistent tokens often provide long-term access that remains active even after an initial password reset. Security teams must transition toward FIDO2-compliant security keys to mitigate these specific device code exploitation risks.