Greatness PhaaS Adds Device-Code Phishing to Hijack Microsoft 365 Accounts

The Greatness phishing-as-a-service platform has expanded from credential theft into a broader Microsoft 365 account-takeover operation by adding device-code phishing alongside adversary-in-the-middle and OAuth abuse techniques. Recent campaigns used RingCentral-themed voicemail and performance-review lures to target cloud identity users, with researchers reporting that the emails abused trusted sender configurations to slip past defenses even when SPF, DKIM, and DMARC checks failed. Victims were redirected to Greatness-controlled infrastructure, where attackers captured MFA-approved authentication tokens instead of just usernames and passwords.

After compromise, operators rapidly replayed stolen tokens from VPS and commercial VPN infrastructure to access Microsoft 365 environments, then used Microsoft Graph API to enumerate mailboxes, Teams chats, SharePoint sites, OneDrive files, contacts, calendars, and registered applications. Researchers also observed device registration activity consistent with attempts to obtain Primary Refresh Token persistence and noted that some malicious access persisted for more than two weeks, with delayed follow-on actions likely intended to evade detection. The reporting highlights a wider shift in phishing kits toward token theft and recommends defenses such as blocking device-code authentication through Conditional Access, enforcing phishing-resistant MFA, and auditing policy exceptions.