As reported by The Hacker News, the Greatness phishing-as-a-service (PhaaS) platform has added device code phishing to its already formidable arsenal — a significant escalation that signals this attack vector is no longer the exclusive domain of sophisticated nation-state actors. When a commercial crimeware kit begins operationalizing a technique, it means the threat is about to reach a far broader pool of targets and a far less technical pool of attackers.

Threat Alert: As reported by The Hacker News, the Greatness phishing-as-a-service (PhaaS) platform has added device code phishing to its already formidable arsenal — a significant escalation that signals this attack vector is no longer the exclusive domain of sophisticated nation-state actors.

Why Device Code Phishing Is Particularly Dangerous

Most security teams have invested heavily in defeating credential phishing — awareness training, MFA mandates, phishing-resistant hardware keys. Device code phishing sidesteps all of that by abusing a legitimate OAuth 2.0 flow: the Device Authorization Grant. This flow was designed for input-constrained devices like smart TVs or printers that cannot easily accept passwords. Attackers weaponize it by generating a real Microsoft (or other IdP) device code and convincing a target to enter it at a legitimate login portal. The victim authenticates with full MFA, and the attacker receives a long-lived refresh token — no credentials stolen, no malware dropped, no alerts fired.

The attack is especially pernicious because the victim completes a genuine authentication flow. There is nothing technically "phished" in the traditional sense — the tokens are issued legitimately by the identity provider.

Refresh tokens tied to the Device Authorization Grant can persist for days or weeks, granting attackers persistent access to Microsoft 365, Azure, and connected SaaS applications long after the initial compromise. Combined with Greatness's existing adversary-in-the-middle (AiTM) session cookie harvesting, defenders are now facing a toolkit that can defeat virtually every form of legacy MFA — SMS OTPs, authenticator app push notifications, and even some forms of soft-token TOTP.

Who Is at Risk

Greatness has historically targeted organizations using Microsoft 365. That puts virtually every mid-market and enterprise organization using Microsoft's cloud productivity suite in the crosshairs. Industries with high-value data and moderate security maturity — manufacturing, financial services, healthcare, and professional services — have been disproportionately targeted in past Greatness campaigns. The addition of device code phishing extends risk to any organization whose Conditional Access policies do not explicitly restrict or audit the Device Authorization Grant flow.

Who Is at Risk
Microsoft 365 / Entra ID tenants without Conditional Access policies blocking device code flow
Organizations relying on push-based MFA (Authenticator app, Duo) as their primary control
Environments where refresh token lifetimes have not been tuned or audited
Help desk and IT staff — high-value targets likely to interact with "device setup" pretexts
Remote and hybrid workforces accustomed to varied authentication prompts

The Commoditization Problem

This development reflects a broader and deeply concerning trend: the rapid commoditization of advanced attack techniques. Device code phishing was first documented in nation-state campaigns — notably by Russian SVR-linked actors (Midnight Blizzard/Cozy Bear) — and has now made its way into a for-hire toolkit available to anyone with a credit card and a Telegram account. The cycle from nation-state technique to crimeware feature is accelerating, and defenders cannot afford to treat "sophisticated" techniques as threats only relevant to high-value targets.

Shield53 Recommendations

Immediate Actions

  • Restrict Device Code Flow in Entra ID: Use Conditional Access policies to block or strictly limit the OAuth 2.0 Device Authorization Grant. Microsoft provides native controls — if your workforce does not require device code authentication for legitimate use cases, block it entirely for all users.
  • Enforce Phishing-Resistant MFA: Transition to FIDO2 hardware security keys or Windows Hello for Business. These are the only MFA methods that provide meaningful protection against both AiTM and device code attacks.
  • Reduce Refresh Token Lifetimes: Audit and configure token lifetime policies in Entra ID. Shorter-lived tokens dramatically limit the attacker's window of access following a successful token theft.
  • Enable Continuous Access Evaluation (CAE): CAE allows Microsoft 365 to revoke tokens in near-real-time when anomalous signals are detected, reducing the value of stolen tokens.
  • Hunt for Device Code Authentication Events: Query your Entra ID sign-in logs for authentications using the device code flow (deviceCode in the authentication method detail). Flag any instances originating from unexpected locations, user agents, or IP addresses.
  • User Awareness — Specifically for Device Codes: Train users to treat any unsolicited request to visit microsoft.com/devicelogin and enter a code as a red flag, regardless of how legitimate the request appears.

Detection Guidance

Security teams should create alerts in their SIEM for sign-in events where authenticationProtocol equals deviceCode and the signing IP or geolocation does not match the user's established baseline. Token refresh activity from unexpected applications or service principals following a device code authentication event should be treated as a high-confidence indicator of compromise.

The Greatness toolkit's evolution is a forcing function for organizations that have delayed phishing-resistant MFA adoption. The window for "good enough" MFA is closing rapidly.