Greatness Phishing‑as‑a‑Service Adds Device‑Code OAuth Attack to Bypass MFA and Harvest Tokens
What Happened — The commercial phishing‑as‑a‑service (PhaaS) platform “Greatness” has released a new module that leverages the OAuth 2.0 Device Authorization Grant (device‑code flow) to trick users into authorizing malicious applications. By abusing this legitimate flow, attackers can obtain OAuth access and refresh tokens without triggering the victim’s multi‑factor authentication (MFA).
Why It Matters for Compliance & Audit Readiness
- The technique directly subverts MFA, a control many SOC 2 CC6.1 (Logical Access) policies rely on for strong authentication.
- Continuous‑compliance programs must evidence that MFA enforcement is complemented by monitoring for anomalous token issuance and by user‑awareness training that covers newer phishing vectors.
- Verisq’s Security Awareness capability can help organizations embed device‑code phishing scenarios into training and provide audit‑ready evidence of policy enforcement.
Who Is Affected – Any organization that uses OAuth‑based SSO or third‑party applications (e.g., SaaS, cloud‑infrastructure, collaboration tools).
Recommended Actions
- Review and tighten MFA policies to require additional verification for device‑code flows (e.g., enforce conditional access or token‑binding).
- Deploy security‑awareness training that includes device‑code phishing simulations and detection tips.
- Implement continuous monitoring for abnormal OAuth token grants and integrate alerts into your SOC 2 evidence collection pipeline.
Source: The Hacker News
Technical Notes – The attack abuses the OAuth 2.0 Device Authorization Grant, a legitimate flow designed for devices with limited input capability. By presenting a forged device‑code page, the adversary captures the user’s consent, bypasses MFA, and receives access/refresh tokens that can be used to access cloud services, email, or other SaaS resources. No specific CVE is involved; the risk stems from protocol misuse and user‑interaction design.