Greatness PhaaS Exploits MFA with Device Code Phishing

• •Greatness PhaaS now enables device-code phishing to bypass MFA.
• •Attackers can maintain access to Microsoft 365 accounts for over two weeks.
• •The method emphasizes token replay over traditional password theft.

The Greatness phishing-as-a-service (PhaaS) platform has introduced device-code phishing, allowing attackers to harvest multi-factor authentication (MFA) tokens without needing victims' passwords. This method enables sustained access to Microsoft 365 tenants for over two weeks after the initial phishing attack. The attack leverages adversary-in-the-middle techniques and OAuth consent abuse, significantly increasing the risk of unauthorized access. The persistence of access tokens highlights a shift in attack vectors, focusing on token replay rather than traditional password theft. This new capability has raised concerns among security professionals regarding the effectiveness of existing MFA implementations. The Greatness platform's capabilities were documented by Cisco Talos and Hornet Security, indicating a growing trend in sophisticated phishing attacks targeting enterprise environments.