Criminals Now Using Device Login Codes to Trick People Into Giving Up Security Tokens

A New Twist on Account Takeover Attacks

Cybercriminals operating the Greatness phishing-as-a-service platform have discovered a fresh method to break into accounts protected by multi-factor authentication (MFA). Instead of attacking the traditional username-and-password combination, they're now exploiting a lesser-known login feature called device codes—essentially creating a backdoor around security systems that millions of people depend on.

Think of MFA like a two-lock security system on your front door. You need both your key (password) and a security code from your phone to enter. This new attack bypasses the second lock entirely by tricking users into handing over a special temporary code designed for logging into devices, like when you connect a smartphone to your smart TV.

Understanding the Attack Method

Device codes work by allowing people to authenticate from devices that don't have keyboards easily accessible—like game consoles or smart speakers. A user gets a short code, visits a website on their computer, enters that code, and suddenly their TV is connected to their account. It's convenient and legitimate.

What makes this dangerous is that attackers are now impersonating legitimate services and convincing people to give them these codes through phishing messages. Once criminals obtain the code, they can use it to access a target's account, steal authentication tokens (the digital keys that keep you logged in), and maintain access long after the user changes their password.

The Greatness service makes launching these attacks disturbingly simple. It's a ready-made toolkit that criminals rent to conduct phishing campaigns at scale, handling everything from fake login pages to message delivery.

Why This Matters for Your Security

This represents a meaningful shift in how attackers think about breaking in. Rather than directly confronting advanced security measures, they're finding the gaps in less-monitored systems. Device code authentication hasn't received the same attention as traditional MFA methods, leaving many organizations and individuals unaware of the risks.

For businesses, this means employees could unknowingly compromise enterprise accounts. For personal users, your email, cloud storage, and social media accounts become vulnerable—especially if you reuse the same login across platforms.

The real danger: Once attackers steal your authentication tokens, they can stay inside your account invisibly, even after you change your password or enable MFA elsewhere.

Protect Yourself Starting Today

• Never enter device codes on websites you didn't initiate. If a login attempt wasn't started by you, don't complete it—even if the request looks official.
• Be skeptical of unexpected login requests. Legitimate companies rarely ask you to authorize logins via messages or emails.
• Review your connected devices regularly. Check your account settings for authorized devices and remove anything you don't recognize.
• Use strong, unique passwords for important accounts so that token theft is less damaging.
• Enable security alerts. Most email and cloud services can notify you when new devices access your account.
• Consider security keys. Physical authentication devices (like USB keys) offer stronger protection than codes sent to your phone.

What Organizations Should Do

IT teams need to monitor device code authentication logs for suspicious activity and consider restricting device code flows for sensitive user accounts. Security awareness training should specifically mention this threat.

As attackers become more creative about bypassing protections, staying informed and cautious about unexpected authentication requests remains your strongest defense.