Qalabka PhaaS ee Greatness ayaa ku daray farsamo cusub oo loo yaqaan 'device code phishing', taas oo u oggolaanaysa weerarayaasha in ay dhaafaan xaqiijinta laba arrimood (MFA) oo ay xadaan token-yada xisaabaadka. Warbixin ay soo saartay shirkadda amniga ee ZeroBEC ayaa muujisay in qalabku hadda taageero AiTM (adversary-in-the-middle), device code phishing, iyo OAuth consent abuse. Qalabku wuxuu kaloo beegsan karaa iCloud, Yahoo, iyo Google Workspace, taas oo muujinaysa horumar laga gaaray ururinta xogaha gelitaanka una gudubtay nidaam weerareed isku xiran. Greatness waxaa markii ugu horraysay si rasmi ah u soo bandhigay Cisco Talos bishii May 2023, waxaana la sheegay in weerarayaashu ay ku beegsan jireen isticmaalayaasha Microsoft 365 tan iyo ugu yaraan bartamihii 2022. Qiimaha rukhsaddu wuxuu hadda ka bilaabmayaa $289 bishii, kaas oo kor uga kacay $120 oo la sheegay horraantii 2024. Rukhsadda waxaa laga heli karaa bot-ka Telegram ee @gr8managerbot, liisanka waxaana laga qaadan karaa ama laga cusboonaysiin karaa xisaabta @greatnessmgr. Haddii uu qof iska diiwaangeliyo, waxaa la siiyaa dashboard uu ku arko tirakoobka ololaha, qaabaynta domainka, xulashada CAPTCHA, iyo in ka badan 11 qaab oo khiyaano oo la soo dejin karo, sida fariimaha codka, wadaagga dokumentiyada, iyo QR codes. Marka qofka la beegsanayo uu gujiyo link-ka khiyaanada ah ee ku jira email-ka, wuxuu maraa shan marxaladood oo dib-u-jiheyn ah. Marxaladahani waxaa ka mid ah ka-hortagga falanqaynta, baarista User-Agent, iyo CAPTCHA, ka hor inta aan lagu gaarin bogga ugu dambeeya, kaas oo noqon kara AiTM proxy ama device code endpoint. Farsamada device code phishing waxay si gaar ah khatar u tahay maxaa yeelay waxay u jiheysaa dhibbanaha bogga rasmiga ah ee Microsoft. Ma jiro bog been abuur ah oo la dhisayo ama la xannibayo, dhibbanuhuna ma arkiyo wax khaldan, maxaa yeelay waxaa kaliya la weydiiyaa lambar gaaban iyo sabab macquul ah si loo geliyo. Weerarradii ugu dambeeyay waxay adeegsadeen fariimo RingCentral oo been abuur ah, kuwaas oo ka faa'iidaystay in qofka la beegsaday uu yahay macmiil dhab ah oo RingCentral ah. Sidaa darteed, fariimuhu waxay gaadheen sanduuqa qofka inkastoo ay ku guuldarreysteen hubinta SPF, DKIM, iyo DMARC, maxaa yeelay waxay ku tiirsanaayeen liiska xarumaha la aamini karo. Kadib marka la helo token-yada, waxaa daqiiqado gudahood dib loogu isticmaalaa, iyadoo la baarayo kheyraadka Microsoft 365 ee dhibbanaha, sida Outlook, Teams, SharePoint, Exchange, OneDrive, xiriirka, jadwalka, iyo barnaamijyada kale. Waxaa sidoo kale la diiwaangelinayaa qalab cusub si loo helo Primary Refresh Token (PRT), kaas oo marin muddo dheer ah u siin kara. Mid ka mid ah ciwaannada IP-ga ee AiTM ayaa la arkay isagoo si firfircoon u xaqiijinaya xisaabta in ka badan laba usbuuc ka dib ololihii hore. Khubaradu waxay ku talinayaan in si guud loo joojiyo isticmaalka habka device code ee nidaamyada, loona wareego MFA adag oo ka hortagga khiyaanada, shaqaalahana la baro in aysan aaminin codsiyada lambarrada lama filaanka ah. Haddii habkan loo baahdo yahay, waa in si joogto ah loo kormeero oo meesha laga saaro marka aan loo baahnayn. Shirkadaha Soomaaliyeed ee adeegsada Microsoft 365 ama Google Workspace, gaar ahaan kuwa yaryar iyo hay'adaha dowliga ah, waa in ay qaadaan tallaabooyinkan si ay u ilaashadaan xisaabaadkooda iyo xogta macaamiishooda. Token la xaday wuxuu u furan karaa albaabka macluumaadka xasaasiga ah muddo dheer.