🟠 High | Source: The Hacker News
The Greatness phishing-as-a-service toolkit has added support for device code phishing, a technique that abuses the OAuth 2.0 Device Authorization Grant flow to bypass MFA and steal authentication tokens. Attackers trick users into entering a device code on a legitimate Microsoft login page, handing over a valid session token without ever exposing their credentials. This makes the attack particularly dangerous because MFA provides no protection — the victim authenticates legitimately, and the attacker receives a fully authorised token.
Security Architect’s Take: Restrict or block the OAuth 2.0 Device Authorization Grant flow in your tenant via Conditional Access policies unless it is explicitly required for device scenarios — in Microsoft Entra ID, this can be enforced by blocking device code flow authentication. Additionally, deploy token protection (token binding) in Conditional Access and monitor for anomalous device code authentication attempts, particularly from unexpected locations or user agents.
Original advisory: Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens