Full Report
The commercial phishing-as-a-service (PhaaS) toolkit known as Greatness has become the latest crimeware solution to add support for device code phishing, a rapidly growing cyber threat that abuses the legitimate OAuth 2.0 Device Authorization Grant to bypass Multi-Factor Authentication (MFA) and seize control of user accounts. "Greatness supports AiTM [adversary-in-the-middle] credential and
Analysis Summary
# Tool/Technique: Greatness PhaaS (Phishing-as-a-Service)
## Overview
Greatness is a sophisticated commercial Phishing-as-a-Service (PhaaS) platform primarily targeting Microsoft 365 business users. It functions as an integrated attack ecosystem that facilitates credential harvesting and session hijacking by bypassing Multi-Factor Authentication (MFA). Recently, the platform has evolved from simple Adversary-in-the-Middle (AiTM) attacks to include Device Code Phishing and OAuth consent abuse.
## Technical Details
- **Type:** Phishing-as-a-Service (PhaaS) Tool / Framework
- **Platform:** Microsoft 365, Google Workspace, iCloud, and Yahoo
- **Capabilities:** AiTM credential/token theft, Device Code Phishing, OAuth consent abuse, and automated lure generation.
- **First Seen:** Mid-2022 (Publicly documented May 2023)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.001 - Phishing: Spearphishing Attachment]
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0006 - Credential Access]**
- [T1557 - Adversary-in-the-Middle]
- [T1528 - Steal Application Access Token]
- **[TA0003 - Persistence]**
- [T1136 - Create Account (via OAuth consent)]
## Functionality
### Core Capabilities
- **AiTM Proxying:** Intercepts authentication traffic in real-time to capture credentials and session cookies, allowing bypass of traditional MFA.
- **Device Code Phishing:** Abuses the OAuth 2.0 Device Authorization Grant. Victims are tricked into entering a code on a legitimate Microsoft/Google page, granting the attacker a token.
- **Comprehensive Dashboard:** Provides operators with campaign statistics, victim heat maps, and management of stolen session cookies.
- **Automated Lures:** Includes over 11 templates (Voicemail, OneDrive, QR codes, Chat Assistance) packaged with HTML, PDF redirectors, and SVGs.
### Advanced Features
- **Hashed Log Security:** Stolen cookies are protected via one-way hashes; only the customer with their specific Telegram 2FA can extract the cleartext data.
- **Anti-Analysis/Evasion:** Utilizes a five-stage redirect chain and CAPTCHA integration (selectable by the operator) to hinder automated scanners and security crawlers.
- **Infrastructure-as-a-Service:** Provides operator-specific API domains (e.g., `api-[token].[base-domain]`) and automated provisioning via Telegram bots.
## Indicators of Compromise
- **Network Indicators:**
- `t[.]me/GreatnessPage` (Telegram Channel)
- `@gr8managerbot` (Telegram Management Bot)
- `@greatnessmgr` (Developer/Support Handle)
- `api-[token][.]` (Dynamic API subdomains used for backend communication)
- **Behavioral Indicators:**
- Multi-stage URI redirections ending in login portals for M365 or Google.
- Unexpected requests for "Device Code" authorization in business environments.
## Associated Threat Actors
- Sold commercially to various **unnamed cybercriminals** and "aspiring" threat actors (over 3,250 subscribers on their primary channel).
## Detection Methods
- **Behavioral Detection:** Monitoring for unusual OAuth Device Code flow requests, especially those originating from external or unmanaged devices.
- **Network Inspection:** Identifying the specific five-stage redirect pattern common to Greatness infrastructure.
- **Token Monitoring:** Flagging session tokens generated from IP addresses that do not match the user's typical geographic profile (though AiTM can sometimes bypass this).
## Mitigation Strategies
- **FIDO2/WebAuthn:** Implement hardware-based security keys which are resistant to AiTM and device code phishing.
- **Conditional Access:** Restrict OAuth device code flows to known, managed devices or specific IP ranges.
- **User Education:** Train users to recognize that "Device Codes" should never be entered unless they are intentionally linking a smart TV or headless device.
- **Session Lifetimes:** Shorten session token durations to reduce the window of opportunity for stolen cookies.
## Related Tools/Techniques
- **Forg365:** Another PhaaS targeting Microsoft 365.
- **DeBull:** A tool specifically noted for abusing Microsoft device code flows.
- **Evilginx2 / Muraena:** Open-source AiTM frameworks that provide similar proxying capabilities.