Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens
The Greatness phishing-as-a-service toolkit now uses device code phishing to exploit OAuth 2.0 Device Authorization Grant, bypassing MFA and hijacking accounts.
Why it matters
This development demonstrates an advanced phishing technique that circumvents traditional multi-factor authentication (MFA), increasing account compromise risk despite existing protections.
SOC impact
Investigate authentication flows involving OAuth 2.0 Device Authorization Grants for suspicious intercept activity; monitor token issuance and OAuth-related telemetry for anomalies that may indicate device code phishing attempts.
Recommended actions
- Monitor OAuth 2.0 device authorization requests and responses for irregular patterns
- Review multi-factor authentication enrollment and usage logs for unexpected activity
- Analyze authentication telemetry for signs of adversary-in-the-middle interception
- Identify and inventory applications using OAuth 2.0 Device Authorization Grant
- Correlate network and endpoint telemetry to detect credential and token theft attempts
Executive Summary
The Greatness phishing-as-a-service (PhaaS) toolkit has integrated a new device code phishing method that leverages the OAuth 2.0 Device Authorization Grant protocol to bypass multi-factor authentication (MFA). This technique employs adversary-in-the-middle tactics to steal credentials and authentication tokens from targeted accounts.
This evolution presents a challenge for traditional MFA defenses, as it exploits legitimate OAuth flows designed for device authorization. Security teams must adapt detection strategies to include monitoring of OAuth grant activity and token issuance, focusing on unusual or unexpected behavior that could indicate phishing operations using this method.
SOC Impact
Investigate authentication flows involving OAuth 2.0 Device Authorization Grants for suspicious intercept activity; monitor token issuance and OAuth-related telemetry for anomalies that may indicate device code phishing attempts.
OAuth 2.0 and MFA Authentication Monitoring
- Monitor OAuth 2.0 device authorization requests and responses for irregular patterns
- Review multi-factor authentication enrollment and usage logs for unexpected activity
- Analyze authentication telemetry for signs of adversary-in-the-middle interception
- Identify and inventory applications using OAuth 2.0 Device Authorization Grant
- Correlate network and endpoint telemetry to detect credential and token theft attempts
Why It Matters
This development demonstrates an advanced phishing technique that circumvents traditional multi-factor authentication (MFA), increasing account compromise risk despite existing protections.