The industrial phishing-as-a-service (PhaaS) toolkit referred to as Greatness has grow to be the most recent crimeware answer so as to add assist for gadget code phishing, a quickly rising cyber menace that abuses the respectable OAuth 2.0 System Authorization Grant to bypass Multi-Issue Authentication (MFA) and seize management of consumer accounts.
“Greatness helps AiTM [adversary-in-the-middle] credential and token theft, gadget code phishing, and OAuth consent abuse, all from the identical operator panel and shared backend infrastructure,” ZeroBEC mentioned in a report shared with The Hacker Information detailing the PhaaS equipment’s newest capabilities.
“The platform now helps AiTM token theft, gadget code phishing, OAuth consent abuse, and a number of goal platforms, together with iCloud, Yahoo, and Google Workspace. This evolution displays the broader pattern of PhaaS platforms increasing from easy credential harvesting to built-in assault ecosystems.”
The phishing platform was first publicly documented by Cisco Talos in Could 2023, highlighting how menace actors are incorporating it of their assaults to focus on Microsoft 365 enterprise customers since no less than mid-2022.
Designed as a method to decrease the barrier of entry for cybercrime, entry to Greatness is facilitated by a subscription obtainable on its public-facing Telegram channel (@GreatnessPage) that has greater than 3,250 subscribers and serves as a central hub for bulletins and have updates.
Aspiring cybercriminals can get hold of a subscription ranging from $289 monthly, up from the $120 monthly determine reported again in January 2024. The subscription gives entry to an operator that features a dashboard with marketing campaign statistics, area configuration, CAPTCHA choice, and over 11 downloadable lure templates protecting voicemail, doc sharing, and QR codes, amongst others.
Operator registration, license provisioning, and assist are provided through a devoted Telegram bot (@gr8managerbot), whereas licenses may be procured or renewed by sending a message to the “@greatnessmgr” account, the developer deal with that oversees operator assist and platform growth.
In a put up shared in November 2025, the operators of the Telegram channel declare that Greatness retains stolen cookies secure and safe through one-way hash safety and that the data may be extracted solely by the purchasers with their Telegram account 2FA code.
If you logged in together with your telegram account and also you insert 2FA in your facet will create a token that solely can entry your logs so be certain solely particular person can entry is you as you see all information is hashed. Solely method is accessing your telegram account so maintain it secure and every part can be nice!
A very powerful factor for any service consumer is privateness. We respect all customers’ privateness as a result of we’ve got been on this enterprise for 8 years and prioritize every part to supply you the most effective expertise. Not like others, we’re at all times trustworthy with our prospects.
Those that buy a subscription by offering their Telegram chat ID and a bot API token can entry the panel by a login web page that requires a consumer ID and a 9-character license key to entry the dashboard. Upon profitable registration, prospects are provisioned an operator-specific area within the format: “api-[token].[base-domain].”
The dashboard is a one-stop store that gives complete marketing campaign statistics, together with the cookies captured and a warmth map of victims. It additionally features a hyperlinks configuration web page to pick their phishing area, CAPTCHA sort, background theme, and the strategy for saving cookies, whereas the attachments part gives greater than 11 downloadable and ready-to-use phishing lure templates which can be packaged as ZIP information.
“Noticed templates embody: AudioLogin, ChatAssistance, WindowsExplorer, Voicemail, OneDrive, QR, VideoPlayer, and extra variants,” ZeroBEC mentioned. “Every template incorporates pre-built HTML, PDF redirectors, SVGs, and letter templates, decreasing the barrier to entry so operators don’t must construct lures from scratch.”
Victims who find yourself interacting with a booby-trapped hyperlink embedded within the phishing e mail traverse by a five-stage redirect chain that implements anti-analysis protections, Consumer-Agent fingerprinting, and a CAPTCHA gate, earlier than taking them to the ultimate vacation spot, which may be both an AitM proxy or a tool code endpoint.
The gadget code phishing department is a brand new addition to Greatness, permitting cybercriminals to leverage the OAuth gadget authorization grant move to silently get hold of tokens with out consumer interplay.
“The primary large shift was adversary-in-the-middle phishing, the place a proxy website sits between the consumer and Microsoft and relays the login in actual time to seize the session cookie,” Pattern Micro mentioned in an evaluation revealed late final month.
“System code phishing is the subsequent step, and in some methods, it’s cleaner for the attacker. There isn’t a pretend login website to construct or to get blocked, and there may be nothing visually incorrect for the consumer to note, as a result of the web page they enter their password on actually is Microsoft. The one uncommon factor is a brief code and a believable motive to enter it.”
Latest campaigns counting on the PhaaS equipment have used spoofed RingCentral voicemail lures that bypass e mail gateways by profiting from secure sender exclusions and land on the victims’ inbox regardless of failing SPF, DKIM, and DMARC checks. This, in flip, exploits the truth that the goal is a respectable RingCentral buyer.
Whereas menace actors have impersonated RingCentral in varied phishing campaigns up to now, the most recent set of assaults provides a brand new dimension.
“The emails will not be merely impersonating RingCentral; they’re exploiting the belief configuration that exists as a result of the goal is an precise RingCentral buyer,” ZeroBEC mentioned.
“Any vendor breach that exposes a buyer listing concurrently exposes which organizations are prone to have that vendor’s area on their secure sender lists. Defenders ought to deal with vendor breach disclosures as a set off to audit and tighten e mail exclusion guidelines for the affected vendor’s domains.”
An evaluation of post-compromise exercise exhibits that harvested authentication tokens are replayed inside minutes from devoted proxy infrastructure, adopted by enumerating varied sufferer Microsoft 365 sources, resembling Outlook, Groups, SharePoint, Trade, OneDrive, contacts, calendars, and different registered functions, through the Microsoft Graph API.
ZeroBEC mentioned it noticed one of many AiTM proxy IP addresses (“38.248.95[.]214”) actively authenticating towards a sufferer’s Microsoft 365 account greater than two weeks after the preliminary phishing marketing campaign, indicating how the extended validity of the tokens can grant attackers continued entry for prolonged intervals.
Different post-compromise actions recorded by Microsoft along side gadget code phishing assaults contain the menace actor registering new gadgets inside minutes of the breach to generate a Major Refresh Token (PRT) for long-term persistence, and ready a number of hours earlier than organising malicious inbox guidelines or exfiltrating delicate e mail information to keep away from speedy detection.
The event comes as phishing continues to be the first preliminary entry vector, with attackers ramping up cascaded phishing campaigns, the place the belief related to a respectable, compromised account is leveraged to launch hyper-personalized lures aimed toward companions and third events.
Greatness is way from the one PhaaS equipment so as to add gadget code phishing. In current months, campaigns have mixed Tycoon 2FA equipment tradecraft with OAuth gadget code authorization flows regardless of a world regulation enforcement operation that disrupted 330 domains related to the phishing service.
“The gadget code phishing pages make use of CAPTCHAs and use multi-hop redirect chains by respectable infrastructure suppliers earlier than the precise phishing web page is proven,” Okta mentioned again in Could 2026. “Latest gadget code phishing pages additionally make use of comparable anti-analysis methods as Tycoon to try to deflect evaluation.”
System code phishing assaults may be prevented by blocking the authentication technique at a world stage in Conditional Entry Insurance policies. It is also suggested to maneuver to phishing-resistant MFA strategies and educate workers to mistrust sudden codes.
“If this move is required in very particular use instances, these customers/sources needs to be explicitly excluded from the insurance policies,” LevelBlue famous. “The permitted utilization of this move shall be repeatedly audited and revoked as quickly because it’s now not needed.”
