Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens
The commercial phishing-as-a-service (PhaaS) toolkit known as Greatness has expanded its capabilities to include device code phishing, a technique that abuses the…
Tag: device code phishing
Greatness PhaaS Toolkit Expands with Device Code Phishing
Greatness is a commercial phishing-as-a-service (PhaaS) toolkit that has evolved to include device code phishing, AiTM token theft, and OAuth consent abuse.…
Tycoon2FA: Adding Device Code Phishing to Its Arsenal
Tycoon2FA is a well-known AiTM phishing kit that added device code phishing support in May 2026. It was previously tracked as the…
Device Code Phishing: The Fastest-Growing Threat of 2026 and How to Defend Against It
Device code phishing, which abuses the OAuth 2.0 device authorization grant to steal access tokens, has rapidly evolved from a niche technique…
Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft
A new phishing-as-a-service (PhaaS) operation called Forg365 is targeting Microsoft 365 accounts using device code phishing, adversary-in-the-middle (AitM) tactics, antibot evasion, AI-assisted…
Forg365 PhaaS Kit Targets Microsoft 365
Forg365 is a phishing-as-a-service (PhaaS) operation that uses device code phishing, AitM tactics, and AI-assisted lures to compromise Microsoft 365 accounts. It…
Kali365: Phishing-as-a-Service Platform with Device Code Phishing
Kali365 is a phishing-as-a-service platform that offers both AiTM and device code phishing capabilities. It was the subject of a standalone FBI…
Okta Observes Device Code Phishing with Anti-Analysis Techniques
Okta reported in May 2026 that recent device code phishing pages employ CAPTCHAs and multi-hop redirect chains through legitimate infrastructure providers. These…
DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts
A sophisticated device code phishing campaign targeting Microsoft 365 accounts has been observed between late June and early July 2026, leveraging collaboration-themed…
Storm-2372: Nation-State Actor Pioneering Device Code Phishing
Storm-2372 is a nation-state threat actor that was among the first to use device code phishing in the wild, starting in 2024.…