New Toolkit Enables Attackers to Steal OAuth Tokens
The commercial phishing‑as‑a‑service platform Greatness has added support for device code phishing, a technique that exploits OAuth 2.0’s Device Authorization Grant to bypass multi‑factor authentication and hijack user accounts.
The Greatness phishing‑as‑a‑service (PhaaS) toolkit has grown into a new threat vector by adding support for device code phishing. This method takes advantage of the OAuth 2.0 Device Authorization Grant, a flow originally designed for headless or limited‑input devices such as smart TVs and IoT appliances.
In a typical device code attack, the victim is redirected to a login page that displays a short code. The attacker then submits that code on a separate device, gaining an access token without ever seeing the victim’s credentials. Because the flow is built into the OAuth standard, it can be used to bypass many multi‑factor authentication (MFA) setups that rely on user interaction.
Researchers noted that Greatness now includes this capability in its library of phishing templates. Attackers can generate a fake device code page, capture the user’s code, and immediately exchange it for a bearer token. The token can then be used to access protected APIs, impersonate the user, or steal sensitive data.
In addition to device code phishing, the toolkit also supports adversary‑in‑the‑middle (AiTM) credential capture. This means that once a user enters their MFA code on the forged page, the attacker can intercept it and combine it with the stolen token to achieve a full account takeover.
Businesses that rely on OAuth for third‑party integrations are now at higher risk. The new feature allows attackers to bypass MFA in a way that is invisible to standard monitoring tools that only check for credential reuse or brute‑force attempts.
Mitigation strategies should include continuous monitoring of OAuth token usage, enforcing short token lifetimes, and employing device‑specific MFA that requires a second factor on the same device used for the authorization grant.
Security teams are advised to audit their OAuth implementations for the presence of the Device Authorization Grant and to consider disabling it for high‑risk applications. Where possible, switching to a more interactive authentication flow such as Authorization Code with PKCE can reduce exposure.
Regulators are beginning to address the gaps exposed by device code phishing. Several industry groups are drafting guidelines that recommend stricter controls on OAuth device flows, including mandatory MFA and enhanced logging.
Looking ahead, the addition of device code phishing to Greatness underscores the need for ongoing vigilance. As attackers refine their tools, defenders must keep their security posture updated and their staff aware of the latest phishing tactics.
The Greatness phishing‑as‑a‑service (PhaaS) toolkit has grown into a new threat vector by adding support for device code phishing. This method takes advantage of the OAuth 2.0 Device Authorization Grant, a flow originally designed for headless or limited‑input devices such as smart TVs and IoT appliances.
In a typical device code attack, the victim is redirected to a login page that displays a short code. The attacker then submits that code on a separate device, gaining an access token without ever seeing the victim’s credentials. Because the flow is built into the OAuth standard, it can be used to bypass many multi‑factor authentication (MFA) setups that rely on user interaction.
Researchers noted that Greatness now includes this capability in its library of phishing templates. Attackers can generate a fake device code page, capture the user’s code, and immediately exchange it for a bearer token. The token can then be used to access protected APIs, impersonate the user, or steal sensitive data.
In addition to device code phishing, the toolkit also supports adversary‑in‑the‑middle (AiTM) credential capture. This means that once a user enters their MFA code on the forged page, the attacker can intercept it and combine it with the stolen token to achieve a full account takeover.
Businesses that rely on OAuth for third‑party integrations are now at higher risk. The new feature allows attackers to bypass MFA in a way that is invisible to standard monitoring tools that only check for credential reuse or brute‑force attempts.
Mitigation strategies should include continuous monitoring of OAuth token usage, enforcing short token lifetimes, and employing device‑specific MFA that requires a second factor on the same device used for the authorization grant.
Security teams are advised to audit their OAuth implementations for the presence of the Device Authorization Grant and to consider disabling it for high‑risk applications. Where possible, switching to a more interactive authentication flow such as Authorization Code with PKCE can reduce exposure.
Regulators are beginning to address the gaps exposed by device code phishing. Several industry groups are drafting guidelines that recommend stricter controls on OAuth device flows, including mandatory MFA and enhanced logging.
Looking ahead, the addition of device code phishing to Greatness underscores the need for ongoing vigilance. As attackers refine their tools, defenders must keep their security posture updated and their staff aware of the latest phishing tactics.