Greatness

Greatness is a phishing as a service platform that provides MFA bypass phishing targeting Google and Microsoft accounts as well as Microsoft device code phishing.

The tool described here is significantly different from earlier  analysis when Greatness was first reported on in 2023. It is unclear as to whether this is an evolution of the same kit by the same operator, or if a different operator has re-used the name.

Microsoft 365 MFA bypass phishing

Greatness performs MFA bypass phishing for Microsoft accounts using a reverse proxy approach. The relaying proxy injects its own malicious scripts into a lightly modified copy of the actual Microsoft login pages.

The typical anti-bot gate landing page URL has the following structure:

• https://api-<key>.<domain>/<email>

After passing through the anti-bot gate, the proxied Microsoft login page is loaded at:

• https://<domain>/common?key=<key>&username=<email>

Submitting credentials to the phishing page results in background network traffic that looks similar to a genuine Microsoft log-in flow:

• POST /common/GetCredentialType?mk=en-US
• POST /common/login

Device code phishing

In addition to MFA bypass phishing, Greatness also provides capabilities for device code phishing. Push first observed device code phishing attacks using the Greatness kit in April 2026.

Docusign shared document lure

After loading the phishing page, the device code to be used in the attack is retrieved with a request made back to a central operator domain, not the phishing lure domain itself:

• GET https://greatness[.]cfd/admin/apifiles.php?action=get_device_code&user_id=<id>

The page will then continuously poll the same endpoint with the poll_token action until the victim has authorised the device code grant:

• POST https://greatness[.]cfd/admin/apifiles.php?action=poll_token

Central device code phishing API and admin panel domains observed by Push as of September 2026:

• greatness[.]cfd
• greatwallwebsite[.]blog
• admin[.].greatoss[.]sbs

Greatness admin panel sign-in

Google Workspace MFA bypass phishing

Push has also observed MFA bypass phishing targeting Google accounts that we assess is likely associated with Greatness. However, this not not been confirmed with high confidence.

The Google phishing variant connects to a remotely hosted browser over a WebSocket to receive HTML to display to the victim and to send victim inputs back to the attacker's browser. The typical anti-bot gate landing page URL has the following structure:

• https://account-<key>.<domain>/<email>

After completing the fake CAPTCHA (POST /verify_captcha), the phishing page loads a saved copy of the Google login page in an iframe (initial.html) to display whilst the remote browser is being started up:

<iframe id="browser-frame-0" class="browser-frame" src="initial.html"
        sandbox="allow-scripts allow-forms allow-same-origin allow-modals"></iframe>
<iframe id="browser-frame-1" class="browser-frame"
        sandbox="allow-scripts allow-forms allow-same-origin allow-modals"></iframe>

The WebSocket is connected to on the path /ws. Messages are sent as JSON objects with a "type" field. The supported client-to-server messages are:

Server-to-client messages are:

In addition to the WebSocket channel, two other key endpoints are used:

• notify_login.php - Sends a copy of the victim's email address when it is entered.
• proxy.php - The HTML includes rewritten URLs for external resources that are retrieved via this proxy endpoint on the phishing domain.

Comments left in the phishing client JavaScript suggest that the remote browser is controlled using the open source undetected-chromedriver project:

// The DOM snapshot from undetected-chromedriver is already fully computed and styled.