Greatness PhaaS Tool Bypasses MFA to Steal Tokens
New device code phishing feature enables multi-factor authentication bypass.
1What is Greatness PhaaS?
Greatness is a cybercrime tool known as phishing-as-a-service (PhaaS). It abuses the OAuth 2.0 Device Authorization Flow to bypass multi-factor authentication (MFA) and hijack user accounts. The tool is designed to steal credentials and tokens. First documented by Cisco Talos in May 2023, the platform primarily targets Microsoft 365 business users.
2New Feature: Device Code Phishing
Greatness has added device code phishing in its latest update. This method allows silent token theft without user interaction. Unlike traditional phishing, it doesn't require creating a fake login page. Users enter a short code on a legitimate Microsoft page, which is then exploited by malicious actors.
3Subscription Model and Cost
Access to Greatness is facilitated through a subscription model on Telegram. The monthly fee was $120 in January 2024 but has now increased to $289. The subscription provides campaign statistics, domain configuration, and access to over 11 ready-made phishing templates. Templates include voicemail, document sharing, and QR codes.
4Campaign Management and Statistics
Greatness operators manage campaigns through a comprehensive dashboard. It displays stolen cookies and a geographical heatmap of victims. Configurations like phishing domain selection, CAPTCHA type, and background themes are also available. Operators don't need to build lures from scratch, thanks to pre-built templates.
5Bypassing Security Measures
Greatness employs anti-analysis protections and User-Agent fingerprinting. Victims go through a five-stage redirect chain upon clicking phishing links, ending at either an AitM proxy or a device code endpoint. Emails bypass SPF, DKIM, and DMARC checks by exploiting trusted sender lists.
6Leveraging RingCentral's Reputation
Recent campaigns use spoofed RingCentral voicemail lures to gain trust. Emails exploit the fact that targets are actual RingCentral customers, leveraging trusted sender lists. ZeroBEC emphasizes that defenders should treat vendor breaches as triggers to audit and tighten security policies.
7Operator Support and License Management
Greatness uses a dedicated Telegram bot (@gr8managerbot) for operator registration, license provisioning, and support. Licenses can be obtained or renewed via the developer account @greatnessmgr. Operators access stolen cookies using their Telegram account's 2FA code. The system stores cookies with one-way hash protection.
8Critical Threat to Cybersecurity
Greatness PhaaS democratizes phishing attacks by lowering the barrier for cybercriminals. Its ability to bypass MFA poses significant risks to organizations. Targeting popular platforms like iCloud, Yahoo, and Google Workspace threatens a broad user base. Defenders should monitor OAuth device flows and tighten security policies.
Original article: The Hacker News — Greatness PhaaS Aracı ile MFA Atlatılarak Token Çalınıyor