A new capability on an established platform
Greatness is not a new threat. Cisco Talos first documented the kit publicly in May 2023, and it has been targeting Microsoft 365 business accounts since roughly mid-2022, sold as a subscription through a Telegram-based operator panel that hides behind ordinary-looking chat interfaces. What changed this week is the addition of device code phishing to its existing menu of adversary-in-the-middle credential theft and OAuth consent abuse, giving subscribers a third, harder-to-detect path into a target account through the same shared backend infrastructure they already know how to run campaigns from.
Researchers at ZeroBEC, who reported the update, described the platform as now supporting AiTM credential and token theft, device code phishing, and OAuth consent abuse in a single package. Bundling three distinct token-theft techniques behind one dashboard lowers the skill bar further for operators who previously had to choose or combine tools, and it gives them a fallback technique when one approach gets blocked by a target's defenses. A single subscription now covers most of the credential-theft paths a criminal group would otherwise need several separate toolkits to assemble.
Why this technique is different from a fake login page
Device code phishing exploits the OAuth 2.0 Device Authorization Grant, a legitimate flow Microsoft and other providers built for devices without a browser, like smart TVs or CLI tools, to authenticate. The attacker initiates a device authorization request, generates a real code, and sends it to the target through a phishing lure asking them to enter it at a legitimate Microsoft URL. The victim types the code into Microsoft's actual login page and authenticates normally, at which point the attacker's original session silently receives a valid access token.
Trend Micro summarized why this matters to defenders in stark terms: there is no fake login site to build or to get blocked, because the victim never leaves Microsoft's real domain. Traditional phishing defenses, URL filtering, look-alike domain detection, browser warnings about untrusted certificates, are built around the assumption that the victim is being redirected somewhere fraudulent. Device code phishing removes that assumption entirely, since every page the victim sees during the attack is genuinely Microsoft's.
MFA bypass by design, not by brute force
The phrase MFA bypass tends to suggest an attacker defeating a one-time code or a push notification through brute force or fatigue. That is not what happens here. The victim's MFA challenge, if one occurs at all in the device flow, is satisfied honestly, because the victim really is authenticating to their real account on the real service. What the attacker steals is the resulting token itself, which already reflects a fully authenticated, MFA-satisfied session.
ZeroBEC's research noted that harvested authentication tokens get replayed within minutes of theft, meaning the window between compromise and active account misuse is measured in single-digit minutes rather than the hours or days security teams often assume they have to respond to a credential exposure. That speed, combined with the technique's ability to sidestep conditional access policies keyed to login page reputation, is what makes device code phishing a meaningfully harder detection problem than password phishing was.
The business model behind the attack
Greatness operates as a straightforward commercial product. Subscribers pay a monthly fee through Telegram-managed bots for access to a dashboard, more than eleven pre-built lure templates, and campaign statistics tracking how many targets clicked through and authenticated. Pricing has climbed steadily as the platform's capabilities have grown: from 120 dollars a month in January 2024 to 289 dollars a month by this reporting, a price increase that tracks the addition of device code phishing and, in November 2025, operator claims of enhanced cookie security through hash protection.
That pricing trajectory is itself a useful signal for defenders. A commercial phishing kit does not raise prices unless its capabilities are landing successful campaigns for its subscriber base, and the fact that Greatness has stayed commercially viable for over three years, with continuous feature investment, means it is generating enough revenue from account compromises to fund ongoing development. This is not a proof-of-concept research technique. It is a product with a customer base and a roadmap.
Beyond Microsoft 365
Microsoft 365 business accounts remain Greatness's primary target, reflecting how deeply embedded Microsoft's identity platform is in enterprise environments and how much downstream access a single compromised 365 account grants into email, SharePoint, Teams, and connected line-of-business applications. But the kit's targeting has expanded to iCloud, Yahoo, and Google Workspace accounts, indicating operators are diversifying beyond the enterprise identity market into consumer and mixed-use accounts where device code flows are similarly available and similarly under-monitored by the platforms that offer them.
For enterprise security teams, the Microsoft 365 focus is the more urgent concern, since a single compromised account with mailbox, file storage, and collaboration platform access can be pivoted into business email compromise, invoice fraud, or lateral movement into connected SaaS tools far more easily than a personal iCloud or Yahoo account can. The consumer targeting is worth tracking too, since executives and finance staff often reuse personal email habits and recovery paths that intersect with corporate identity in ways security teams rarely map.
What defenders should actually change
Standard MFA policy will not stop this technique, because the attacker never has to defeat MFA directly. Organizations should evaluate whether they need the device authorization grant enabled at all for their tenant, and if they do, restrict which applications and conditional access policies can complete it, treating it the same way a well-run identity program treats legacy authentication protocols that bypass modern conditional access controls entirely. Microsoft, Google, and other identity providers expose tenant-level settings to disable or scope this flow, and most organizations have never touched them because nobody flagged the risk before now.
Security teams should also build specific detection for device code authentication events, since these often look identical to legitimate sign-ins from a risk-scoring perspective, and reduce the token lifetime for sessions created through this flow where the platform allows it. Given that replay happens within minutes, any monitoring strategy built around daily or even hourly log review is functionally too slow, this requires near real-time alerting tied directly to device code grant activity, not general anomalous login detection. User education still has a role, but it is a weak backstop against a flow that looks and feels exactly like a legitimate sign-in prompt, and it should never be the only control a program relies on to catch this class of attack.
