Affected Systems

Organizations using Microsoft 365, Google Workspace, iCloud, and Yahoo with OAuth 2.0 authentication. Particularly at risk: RingCentral customers targeted via spoofed voicemail lures exploiting safe sender trust configurations. Threat actors subscribe to Greatness PhaaS starting at $289/month via Telegram.

Exploitation Status

Actively exploited in the wild since mid-2022. Greatness PhaaS toolkit now includes device code phishing (new capability as of 2026), AiTM proxy attacks, and OAuth consent abuse. Recent campaigns use spoofed RingCentral voicemail lures that bypass SPF/DKIM/DMARC via safe sender exclusions. Over 3,250 Telegram subscribers have access to the platform.

Business Impact

Attackers can bypass MFA and steal session tokens without triggering traditional phishing detection. Device code phishing leverages legitimate Microsoft OAuth pages, making detection difficult—users see real Microsoft login pages with only a device code prompt. Campaigns bypass email gateways by exploiting trusted sender relationships (e.g., RingCentral customers). Stolen tokens grant persistent access to cloud accounts (M365, Google Workspace, iCloud, Yahoo) even after password resets. No CVE applies—this is an abuse of legitimate OAuth 2.0 Device Authorization Grant flow, not a software vulnerability.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Block OAuth Device Authorization Grant flow at the tenant level for Microsoft 365 and Google Workspace unless explicitly required for legitimate device onboarding (e.g., smart TVs, IoT devices).
  • Implement Conditional Access policies requiring device compliance and trusted locations for OAuth token issuance; flag or block device code authentication attempts from unexpected geolocations.
  • Review and remove safe sender/allowlist exceptions for third-party services like RingCentral; enforce strict SPF/DKIM/DMARC validation even for known vendors.
  • Monitor Azure AD/Entra ID sign-in logs for UserCode authentication method and investigate device code grants (Event ID 4769 or sign-in logs with authenticationMethod = deviceCode).
  • Deploy user awareness training specifically covering device code phishing scenarios—emphasize that legitimate Microsoft pages can still be part of phishing attacks if a suspicious code entry is requested.