**The Rising Threat of PhaaS: How Greatness Kit Exploits OAuth for Account Takeover**
The evolution of phishing-as-a-service (PhaaS) kits has reached a new and dangerous level with the rise of platforms like “Greatness.” This crimeware no longer relies solely on crude email spoofing; instead, it weaponizes legitimate web protocols to bypass even robust security measures. Specifically, Greatness has incorporated device code phishing—a method that abuses the OAuth 2.0 Device Authorization Grant—to circumvent Multi-Factor Authentication (MFA) and steal session tokens directly from the victim’s browser.
According to a report by ZeroBEC, which analyzed the Greatness PhaaS kit, this platform offers a comprehensive “attack ecosystem” rather than just a simple phishing page. Greatness supports Adversary-in-the-Middle (AiTM) attacks, token theft, and OAuth consent abuse, all delivered from a unified operator panel. What makes this particularly insidious is that the malicious infrastructure can target major platforms, including iCloud, Yahoo, and Google Workspace, allowing attackers to cast a wide net with a single toolkit.
The kit was first documented by Cisco Talos in mid-2023, but it has since evolved into a commercial product that is both accessible and “user-friendly” for criminals. Subscription tiers, advertised on the platform’s Telegram channel, start at around $289 per month. For this price, subscribers gain access to a dashboard where they can configure campaigns, select lures, and view real-time statistics of compromised accounts.
Perhaps the most alarming feature of Greatness is its implementation of device code phishing. Unlike traditional phishing, which requires building fake login pages, this method directs the victim to a legitimate Microsoft (or other service) login screen. The attacker then tricks the user into entering a short, device-based code that appears as a normal part of the sign-in process. Because the page is genuine, users see no visual red flags, and the MFA prompt is bypassed entirely. Once the attacker intercepts the resulting authentication token, they can replay it to gain persistent access to the victim’s email, calendar, files, and linked applications—often for weeks or even months.
The post-compromise activity is equally concerning. Analysis shows that attackers can enumerate emails, contacts, calendars, and files through Microsoft Graph API within minutes of the initial breach. They often register new devices to generate Primary Refresh Tokens (PRTs), ensuring long-term persistence, and they carefully time exfiltration to avoid detection.
Ultimately, the rise of kits like Greatness highlights how PhaaS is becoming a mature and scalable cybercrime industry. By lowering technical barriers and offering subscription-based “support,” these platforms empower even low-skilled attackers to launch sophisticated campaigns. Organizations must therefore re-evaluate their defenses, moving beyond simple password checks and towards phishing-resistant MFA, strict Conditional Access policies, and continuous monitoring for anomalous token usage.
—
### FAQ
**What is Greatness?**
Greatness is a Phishing-as-a-Service (PhaaS) toolkit that enables cybercriminals to launch automated phishing campaigns. It recently added support for device code phishing, which exploits OAuth 2.0 flows to bypass MFA and steal session cookies without needing to build fake login pages.
**How does device code phishing work?**
In a device code attack, the victim is redirected to a legitimate login page (such as Microsoft’s). They are then asked to enter a short code displayed on the screen. Unbeknownst to them, this process authenticates the attacker’s session in the background, allowing the attacker to steal the resulting authentication token.
**Which platforms are targeted by Greatness?**
Greatness targets multiple platforms, including iCloud, Yahoo, and Google Workspace, making it a versatile tool for attackers looking to compromise a variety of cloud services.
**How can organizations defend against these attacks?**
Organizations should enforce phishing-resistant MFA, implement strict Conditional Access Policies that block legacy authentication methods, and conduct regular audits of authorized devices and tokens. Employee training to recognize unusual authentication requests is also critical.
—
### Conclusion
The Greatness PhaaS kit represents a significant step forward for cybercriminals, merging ease of access with sophisticated attack techniques. By exploiting OAuth device code flows, it effectively neutralizes one of the most common security layers—MFA—making account compromise nearly indistinguishable from legitimate user activity. As these toolkits become more widespread and automated, the responsibility shifts from individual vigilance to enterprise-level security controls. Organizations must adopt a zero-trust mindset, assuming that phishing will succeed and designing their defenses to limit the damage when credentials are stolen. The era of simple spam emails is fading; in its place is a new age of silent, token-based warfare that requires equally advanced defenses.
