Greatness expands its toolkit for getting past multi-factor authentication

ZeroBEC published an analysis of the phishing service Greatness on 4 August 2026. The analysis shows that the service has grown from harvesting passwords into a broader platform combining adversary in the middle, device code phishing and OAuth abuse in order to bypass multi-factor authentication and steal authentication tokens. ZeroBEC points out that multi-factor authentication alone is insufficient without stronger control and monitoring of OAuth permissions, device code flows and suspicious sessions.

What happens technically

The three techniques attack the same target from different sides, and the target is the token proving that the user is signed in. Adversary in the middle places a copy of the login page between the user and the service, passes everything on in real time and keeps the session. The user notices nothing, because the login genuinely succeeds.

Device code phishing abuses an entirely legitimate feature. Devices without a keyboard, such as displays and meeting room equipment, ask the user to visit a login page and enter a short code. The attacker starts such a login, sends the code to the victim with a credible reason, and the victim in effect approves the attacker's session. OAuth abuse follows the same logic. Instead of stealing the password the attacker asks the user to grant an application access, and a granted permission keeps working after a password change. The common trait is that none of the techniques break multi-factor authentication. They go around it, by collecting the result of the login rather than attacking the login itself.

What this means for you if you manage logins and access

If you rolled out multi-factor authentication and considered identity risk settled, this is the uncomfortable follow up. Multi-factor authentication stops mass password attacks, and it still does that job. It does not stop an attacker who gets one of your users to approve something. Nor does it stop an attacker who takes over the finished session. Berigo's assessment is that multi-factor authentication is still necessary, but that it can no longer be your whole answer to identity risk.

The practical answer sits in three settings you most likely already have, but which few have decided on. Who may approve a third party application connecting to the organisation's data. Whether device code login should be allowed at all, and if so for whom. Who watches for a session suddenly used from another country or an unknown client. Berigo finds that all three tend to sit at defaults nobody chose. If your organisation is covered by NIS2, this is access control under Article 21, and we consider it among the cheapest improvements you can make.

Berigo recommends

• Turn off device code login where it is not needed, and restrict it to the devices that genuinely require it.
• Require administrator approval before third party applications gain access to organisational data through OAuth.
• Review which applications already hold access, and remove those nobody can account for.
• Monitor sessions used from new countries, new devices or unusual clients, and make it possible to revoke a session quickly.
• Introduce phishing resistant login for the accounts with the most to lose.