The commercial phishing-as-a-service (PhaaS) toolkit called Greatness, distributed via Telegram that uses token theft with device code and adversary-in-the-middle (AiTM) credential phishing in single operator products, has become a latest crimeware tool for the threat actors.
About the campaign
Experts found a live campaign that abused spoofed customer-side safe sender exclusions and RingCentral emails to escape email gateway checks and send phishing traps attacking Microsoft 365 accounts.
"Greatness supports AiTM [adversary-in-the-middle] credential and token theft, device code phishing, and OAuth consent abuse, all from the same operator panel and shared backend infrastructure," ZeroBec, who discovered the campaign, said in a report.
"The platform now supports AiTM token theft, device code phishing, OAuth consent abuse, and multiple target platforms, including iCloud, Yahoo, and Google Workspace. This evolution reflects the broader trend of PhaaS platforms expanding from simple credential harvesting to integrated attack ecosystems."
The phishing platform was first found by Cisco Talos in May 2023, showing how hackers are including it in their campaigns to attack Microsoft 365 business users since May 2022.
About the subscription
Built to ease cybercrime, access to Greatness is given through a subscription available on Telegram channel called @GreatnessPage having over 3,250 subscribers and works as a central hub for feature updates and announcements. Hackers can get a subscription at $289 per month, rising from $120 per month from January 2024. The subscription offers access to an operator that consists of a dashboard with CAPTCHA selection, domain configuration, campaign statistics, and more than 11 downloadable trap templates including QR codes, voicemail, and document sharing.
How is Telegram used?
The operators of Telegram channel in November 2025 said that Greatness keeps stolen cookies secure through one-way hash protection and the information can be taken out only by the customers via their Telegram account two factor authentication code.
Threat actors that buy a subscription by giving their bot API token and Telegram chat ID can use the panel via an “O365 Panel” login page that needs a 9-character license key and a user ID. Once registered, customers are shown a dashboard and an operator-particular domain.
The dashboard is a standard place that provides campaign statistics such as heat map of victims and captured cookies. "Observed templates include: AudioLogin, ChatAssistance, WindowsExplorer, Voicemail, OneDrive, QR, VideoPlayer, and additional variants. "Each template contains pre-built HTML, PDF redirectors, SVGs, and letter templates, lowering the barrier to entry so operators do not need to build lures from scratch."
Read the original article: