Criminals using the “Greatness” phishing-as-a-service kit are running real-world phishing campaigns that trick employees into approving a Microsoft device-code login flow, allowing attackers to bypass MFA and steal access tokens. Recent activity includes RingCentral “voicemail” lures and multi-step redirect chains with CAPTCHA and anti-analysis checks, ending at either an adversary-in-the-middle (AiTM) proxy or a device-code endpoint. Once attackers have tokens, they can quickly access Microsoft 365 data (Outlook, Teams, SharePoint, OneDrive) and maintain access for weeks.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “New voicemail received (RingCentral), listen to message.” Looks normal, lands right in your inbox. You click. Now it’s a five-step maze: redirects, a CAPTCHA, then a real Microsoft page asking you to enter a short device code to hear the voicemail. This is the Greatness kit using Microsoft’s legit device-code flow. There’s nothing visually wrong. The only clue: you weren’t expecting a device code for a simple voicemail. If you ever see a surprise Microsoft device code prompt, stop. Don’t enter it, report the email or page to Security immediately.
This article describes real-world “device code phishing” campaigns where victims are tricked into approving an OAuth device login, granting attackers access without stealing passwords. It highlights rapid criminal adoption via phishing-as-a-service kits and notes heavy targeting of Microsoft…
Microsoft and ReliaQuest report a real campaign where attackers tampered with public Wi‑Fi captive portal networks (hotels/conference venues) to redirect users to attacker-controlled pages. The goal was to steal Microsoft 365 credentials (and sometimes deliver malware) by using…
Attackers sent emails that looked like Microsoft Teams/HR notifications and pushed users through Microsoft’s real sign-in and OAuth consent screens. When victims approved the requested permissions, the attackers obtained an authorization token and could access Microsoft 365 data like Outlook,…
Attackers trick employees into entering a short “device code” on a real Microsoft sign-in page (microsoft.com/devicelogin), causing Microsoft 365 to issue login tokens directly to the attacker. Because the victim completes a legitimate MFA-approved sign-in on a legitimate Microsoft URL, the…
Microsoft observed real-world campaigns where victims were tricked by “ClickFix” prompts into pasting a command into Windows Run, which then installed ACR (Amatera) Stealer. The malware steals saved browser passwords, live session tokens, and Microsoft 365/OneDrive/SharePoint files, meaning…
Kali365 is a phishing kit that abuses Microsoft’s real “device code” sign-in flow to trick employees into approving attacker-controlled login codes. Once a victim completes authentication on Microsoft’s legitimate page, attackers can receive access and refresh tokens that may grant ongoing access…
