Listen to this Post
Introduction: Phishing Is No Longer Just About Stealing Passwords
Cybercriminals are rapidly transforming phishing into a sophisticated commercial industry. Instead of relying on poorly designed fake login pages and mass spam campaigns, attackers are now renting enterprise-grade phishing platforms that provide everything needed to compromise organizations with minimal technical knowledge. One of the most concerning examples is Greatness, a phishing-as-a-service (PhaaS) platform that continues to evolve with advanced capabilities designed specifically to target Microsoft 365 users.
The latest version of Greatness marks a dangerous shift in cybercrime. Rather than focusing only on collecting usernames and passwords, it now specializes in stealing authenticated sessions, OAuth tokens, and abusing Microsoft’s legitimate authentication mechanisms. These techniques significantly reduce the effectiveness of traditional Multi-Factor Authentication (MFA), making organizations far more vulnerable even when they believe their accounts are protected.
Greatness PhaaS Continues to Expand Its Arsenal
Greatness is marketed through private Telegram channels for approximately $289 per month, making advanced phishing operations available to almost anyone willing to pay. Subscribers receive access to a centralized management dashboard, campaign statistics, customizable phishing domains, CAPTCHA protection, and more than eleven professionally designed phishing templates.
The subscription model reflects how cybercrime has matured. Instead of building phishing infrastructure from scratch, criminals simply subscribe to a service, configure their campaign, upload email lists, and launch attacks within minutes.
From Password Theft to Session Hijacking
Greatness has been targeting Microsoft 365 environments since at least 2022, but its newest updates demonstrate a major evolution in attacker strategy.
Modern phishing campaigns no longer prioritize passwords alone. Instead, they seek to steal:
Microsoft authenticated session cookies
OAuth access tokens
Device authorization tokens
Long-lived cloud authentication sessions
This allows attackers to access Microsoft cloud resources even after users successfully complete Multi-Factor Authentication.
In many situations, stealing an authenticated session is considerably more valuable than obtaining the password itself.
Professional Templates Make Campaigns Highly Convincing
Greatness provides attackers with professionally crafted phishing templates that imitate legitimate business communications.
Examples include:
RingCentral voicemail notifications
Microsoft OneDrive sharing requests
Microsoft document collaboration alerts
QR code authentication pages
Secure audio login portals
Video playback notifications
PDF redirect documents
Corporate letter-style messages
Each template includes ready-to-use HTML pages, SVG graphics, redirect scripts, and supporting files, allowing operators to launch convincing campaigns without web development skills.
Subscription-Based Cybercrime Lowers the Barrier to Entry
Perhaps the most alarming aspect of Greatness is how simple it makes sophisticated phishing attacks.
Subscribers receive:
Dedicated phishing domains
Configurable landing pages
Multiple CAPTCHA options
Cookie storage management
Campaign tracking
Email statistics
Victim management dashboards
This dramatically lowers the technical expertise required to conduct enterprise-grade phishing attacks.
Cybercrime increasingly resembles a legitimate Software-as-a-Service (SaaS) business, complete with subscriptions, customer support, regular updates, and feature releases.
Trusted Vendor Emails Become Dangerous Weapons
Researchers observed campaigns impersonating RingCentral voicemail notifications sent toward organizations that legitimately use RingCentral services.
Instead of sending random phishing emails, attackers leverage trusted brands that employees interact with daily.
Even more concerning, some organizations had configured broad allowlisting rules for trusted vendors.
As a result, phishing emails reached inboxes despite failing:
SPF validation
DKIM verification
DMARC authentication
This demonstrates why blindly trusting vendor domains creates significant security risks.
Complex Redirect Chains Hide Malicious Activity
Victims clicking phishing links do not immediately reach the fake login page.
Instead, Greatness employs a sophisticated five-stage redirect process designed to evade detection.
The chain includes:
Browser fingerprinting
Anti-analysis checks
Sandbox detection
Security researcher filtering
CAPTCHA verification
Dynamic redirects
Only legitimate human victims eventually arrive at the phishing portal.
Security scanners and automated analysis systems frequently fail long before reaching the final payload.
Adversary-in-the-Middle Attacks Are Becoming Mainstream
One of
Unlike traditional phishing websites that simply steal passwords, an AiTM attack acts as a live proxy between the victim and Microsoft’s legitimate authentication service.
The victim unknowingly logs into the real Microsoft login portal through the attacker’s proxy.
The attacker captures:
Username
Password
MFA challenge responses
Authentication cookies
Session tokens
Because authentication occurs successfully, Microsoft treats the session as legitimate.
The attacker receives an authenticated session cookie that can often be reused without requesting MFA again.
Session Cookies Are the New Gold
Modern cloud authentication relies heavily on session tokens.
Once authentication succeeds, users receive encrypted cookies proving their identity.
If attackers steal these cookies, they frequently gain immediate access without knowing the actual password.
This explains why
Organizations relying solely on MFA may incorrectly assume their accounts remain protected.
Device-Code Phishing Introduces Another Serious Threat
Greatness also now supports OAuth Device Authorization Grant abuse.
Rather than sending victims to fake Microsoft login pages, attackers direct them to Microsoft’s legitimate device verification website.
Victims simply enter a supplied device code, believing they are completing a legitimate verification process.
Behind the scenes, that authorization grants attackers access to the victim’s Microsoft account.
Since users interact directly with
Traditional phishing awareness training may not prepare users for this increasingly popular technique.
Beyond Microsoft 365
Although Microsoft 365 remains the primary target, Greatness also supports campaigns targeting:
Google Workspace
Yahoo
Apple iCloud
This demonstrates the
Deep Analysis
Greatness illustrates how phishing has evolved into a modular cybercrime ecosystem. Rather than isolated threat actors creating individual phishing pages, criminal groups now develop reusable platforms that behave much like commercial software products. Continuous feature updates, customer subscriptions, and technical support enable attackers with limited experience to launch campaigns that were once reserved for highly skilled operators.
The combination of AiTM proxies, OAuth abuse, and device-code phishing significantly weakens the security assumptions many organizations place on Multi-Factor Authentication. While MFA remains an essential defense, it cannot fully protect authenticated sessions that have already been established.
Security teams should prioritize identity-centric monitoring alongside endpoint protection. Detecting impossible travel events, unusual token reuse, anomalous OAuth consent grants, and unexpected device registrations can reveal attacks that password monitoring alone will miss.
Organizations should also review email security policies to ensure trusted vendor domains are not broadly allowlisted without additional validation. Attackers increasingly exploit legitimate business workflows because users are naturally less suspicious of familiar brands.
Administrators can strengthen Microsoft environments by implementing Conditional Access policies, enforcing phishing-resistant authentication methods such as FIDO2 security keys, restricting OAuth application consent, monitoring sign-in logs, shortening session lifetimes where appropriate, and deploying continuous identity risk evaluation.
Example Microsoft Graph PowerShell Commands
Connect to Microsoft Graph
Connect-MgGraph -Scopes "AuditLog.Read.All","Directory.Read.All"
Review recent sign-in events
Get-MgAuditLogSignIn -Top 25
List enterprise applications
Get-MgServicePrincipal
Review OAuth permission grants
Get-MgOauth2PermissionGrant
List registered devices
Get-MgDevice
Review Conditional Access policies
Get-MgIdentityConditionalAccessPolicy Microsoft Defender Hunting (KQL) SigninLogs | where ResultType == 0 | where AppDisplayName contains "Microsoft" | summarize count() by UserPrincipalName, IPAddress, Location AADNonInteractiveUserSignInLogs | where AuthenticationRequirement == "multiFactorAuthentication" | project TimeGenerated, UserPrincipalName, IPAddress What Undercode Say:
The evolution of Greatness represents one of the clearest examples of how cybercrime is becoming increasingly industrialized.
Instead of isolated phishing kits sold on underground forums, attackers now subscribe to continuously maintained cloud platforms.
This business model dramatically accelerates innovation among criminal groups.
The addition of AiTM capabilities signals that attackers understand authentication better than ever before.
MFA remains important, but it is no longer the final security boundary.
Identity has become the new perimeter.
Stealing authenticated sessions is significantly more profitable than stealing passwords.
Session hijacking bypasses many traditional security assumptions.
OAuth abuse is likely to become even more common during the next few years.
Device-code phishing is particularly dangerous because users interact with Microsoft’s legitimate infrastructure.
That reduces visual indicators typically associated with phishing.
Organizations should move toward phishing-resistant authentication standards.
FIDO2 hardware keys remain one of the strongest available defenses.
Continuous session monitoring is becoming essential.
Behavioral analytics will play an increasingly important role.
Security Operations Centers should monitor token creation alongside credential usage.
Email filtering alone cannot stop modern phishing.
User awareness training must evolve.
Employees need to recognize device-code scams.
Cloud security teams should audit OAuth permissions regularly.
Least-privilege access remains critical.
Identity governance deserves the same attention as endpoint protection.
Attackers increasingly exploit trust relationships rather than software vulnerabilities.
Organizations should review trusted sender policies immediately.
Broad allowlisting introduces unnecessary risk.
Cloud logs provide valuable indicators during incident response.
Session revocation should become a standard containment procedure.
Organizations should reduce long-lived authentication tokens whenever operationally possible.
Conditional Access policies significantly improve resilience.
Attack simulation exercises should include AiTM phishing scenarios.
Purple-team exercises can validate detection capabilities.
Incident response teams should practice token revocation workflows.
Threat intelligence sharing will become increasingly valuable.
Commercial phishing platforms will continue evolving rapidly.
Artificial intelligence may soon automate phishing customization.
Future phishing campaigns could become even more personalized.
Organizations that adopt Zero Trust identity strategies today will be better prepared.
Defenders must focus on identity protection rather than passwords alone.
The cybersecurity industry is shifting toward protecting authenticated sessions instead of login events.
Greatness is unlikely to be the last platform introducing these techniques.
It is simply one of the earliest examples demonstrating where phishing is heading.
Security strategies built five years ago are no longer sufficient.
Modern identity security must evolve at the same pace as attacker innovation.
✅ Fact: Greatness has evolved beyond traditional credential theft by incorporating Adversary-in-the-Middle (AiTM) phishing, device-code attacks, and OAuth consent abuse. These techniques are actively discussed by security researchers and align with current attack trends targeting Microsoft 365.
✅ Fact: Session cookies and OAuth tokens can allow attackers to access cloud resources without repeatedly triggering Multi-Factor Authentication. This is a well-documented limitation of session-based authentication and one reason why identity monitoring is becoming increasingly important.
✅ Fact: Organizations that broadly allowlist trusted vendor domains may inadvertently increase phishing risk. Security best practices recommend layered email validation and continuous monitoring rather than relying solely on sender reputation.
Prediction
(+1) Identity security technologies will rapidly advance over the next few years, with organizations adopting phishing-resistant authentication methods, continuous session validation, AI-driven anomaly detection, and stricter OAuth governance. As defenders strengthen identity-centric security, phishing platforms like Greatness will face increasing resistance, forcing attackers to invest in even more complex techniques while enterprises become significantly better at detecting and disrupting session hijacking before major compromises occur.
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.quora.com/topic/Technology
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
