You Don't Have to Hack In, You Just Have to Log In: Phishing's New Engineering Problem- 315

August 6, 2026

For twenty years, phishing's basic engineering problem was getting a password. Multifactor authentication and email-gateway blocklists were built to make that theft insufficient on its own — a stolen password alone shouldn't grant access, and a malicious link or attachment alone shouldn't reach an inbox. Three pieces of research surfacing in the same window show that phishing's engineering problem has quietly changed to match: attackers are no longer trying to defeat MFA and blocklists through brute effort or better disguise. They're routing around both, using mechanisms that were never designed with this kind of abuse in mind, and a growing share of that tradecraft is now available as a monthly subscription rather than something only a state intelligence service could build.

CrowdStrike's newly released 2026 Threat Hunting Report puts numbers to a shift that has been building for years. Device code phishing — a technique invented in a 2020 blog post by Microsoft researcher Nestori Syynimaa, ignored for four years, then weaponized for the first time in August 2024 by a Russian state actor CrowdStrike tracks as Storm-2372 — increased fifteenfold in the first half of 2026 compared to the second half of 2025, with the Russian APT group Cozy Bear now leading a "diverse set" of cybercriminals who have adopted the technique wholesale, building dedicated device-code infrastructure and delivering phishing pages through Entra ID's own OAuth redirection flow at scale. What makes device code phishing worth taking seriously as a category, rather than just one more lure, is that it doesn't try to steal a password or intercept an MFA code at all — it tricks a victim into approving what looks like a legitimate device sign-in request, and the victim's own approval hands the attacker a valid authentication token directly, through the exact mechanism Microsoft built for signing into a smart TV or printer. There is no credential to phish and no second factor to defeat, because the user completes the real authentication flow themselves. Vishing shows a related but distinct route to the same destination: CrowdStrike measured a 134 percent rise in voice phishing from 2024 to 2025, followed by a further doubling from the second half of 2025 into the first half of this year, driven largely by two threat actors, Cordial Spider and Snarky Spider, who direct victims to SSO-themed adversary-in-the-middle pages specifically on their mobile devices — a deliberate choice, since the endpoint security software organizations install lives almost exclusively on laptops and desktops, leaving phones as a comparatively unmonitored channel. Once a victim hands over credentials and a live MFA code, the attackers don't just log in once; they register their own device as a trusted MFA method, which defeats the entire premise of a second factor going forward, since the victim's own password reset does nothing to remove an attacker's device that MFA now considers legitimate. CrowdStrike documented one case where Cordial Spider vished a victim, authenticated, and registered a new MFA device in four minutes flat — fast enough that the new-device alert itself was the only thing that saved the victim, triggering detection and eviction twelve minutes later. As CrowdStrike's Adam Meyers put it plainly: "There's technical controls in place for email phishing... targeting humans, targeting the help desk, is way more effective. You don't have to hack in, you just have to log in."

The Greatness phishing-as-a-service platform shows what happens when techniques like these stop being bespoke APT tradecraft and become a packaged product. Researchers at ZeroBec found a live Greatness campaign spoofing customer-side safe-sender exclusions and abusing RingCentral's own legitimate email-sending reputation specifically to sail past the email-gateway filters that rely on sender trust and blocklists to catch phishing before it reaches an inbox. But the platform's real significance is architectural: Greatness now supports AiTM credential and session-token theft, device code phishing, and OAuth consent abuse — a third and distinct route around MFA, in which a victim is tricked into granting a malicious registered application ongoing API permissions to their account, permissions that persist without ever requiring another password or MFA prompt — all from a single operator panel and shared backend infrastructure, and the platform has expanded its targeting beyond Microsoft 365 to iCloud, Yahoo, and Google Workspace. This is, in other words, the same portfolio of MFA-defeating mechanisms CrowdStrike documented at the nation-state and APT-follower level, now consolidated into one dashboard and sold as a subscription: access runs $289 a month, up from $120 in January 2024, distributed through a Telegram channel with more than 3,250 subscribers that functions as a running changelog and support hub. Buyers get a dashboard with CAPTCHA selection, domain configuration, live campaign statistics, and more than eleven pre-built lure templates — fake voicemail notifications, QR codes, document-sharing prompts, a fake Windows Explorer window — engineered so an operator with no development skill can launch a credible campaign without building anything from scratch. Stolen cookies are protected behind one-way hashing and can only be extracted by the paying customer through their own Telegram two-factor authentication, a small but telling detail: even the criminal supply chain here has adopted the industry's own security hygiene to protect its product from being stolen out from under it.

Where Greatness consolidates MFA-defeating techniques, a newer platform called DOUBLECUP shows the same commercial model applied specifically to defeating blocklists. SOCRadar's Threat Research Unit found the Russian loader-as-a-service, active since June 2026, hiding malicious code inside PNG images that a victim's own browser caches during an entirely ordinary page visit — meaning the malicious bytes never arrive as a separate file for a scanner to flag, because they're smuggled inside image data the browser was always going to download and store locally anyway. DOUBLECUP customers run ClickFix-style fake CAPTCHA pages impersonating login portals for NetSuite, Odoo, HubSpot, and Salesforce; visiting one forces the browser to cache a steganographic image, then displays instructions convincing the victim to paste and manually run a command already copied to their clipboard. That command searches the browser's own cache for the image by its exact file size, extracts a hidden first-stage payload using nothing more exotic than the built-in findstr or certutil utilities, and launches a fileless second-stage dropper that derives its final decryption key from the victim's own public IP address before executing entirely in memory. Two payloads ride this chain: an updated, cross-platform version of CountLoader, which fingerprints cryptocurrency wallets and Signal Desktop installations before establishing persistence, and a previously undocumented Python-based Windows RAT called DeviceManager, which resolves its command-and-control address using EtherHiding — reading the current C2 location out of a smart contract on the Ethereum or Polygon blockchain, an address that no blocklist or takedown request can remove, since it lives on a public ledger nobody controls. DOUBLECUP is not the first to hide payloads inside cached images — Huntress had previously documented the same steganographic trick delivering LummaC2 and Rhadamanthys — but it packages the entire chain, from steganographic hosting to blockchain-resolved command infrastructure, as a licensed product: customers build and host the ClickFix-style lure page themselves, and DOUBLECUP handles everything else, down to automatically rebuilding payloads as needed.

What connects device code phishing, vishing, Greatness, and DOUBLECUP is that none of them are trying to out-argue MFA or blocklists — they're built to make both irrelevant by construction. A device-code approval or an OAuth consent grant hands over legitimate access without a password or a second factor ever entering the picture; a newly registered MFA device survives a password reset because MFA itself now considers the attacker legitimate; a payload hidden inside a browser's own image cache and pulled out with built-in system tools never presents as a file a blocklist could recognize; and a command-and-control address resolved from a public blockchain simply has no domain or IP for anyone to block. None of this required a technical breakthrough in the traditional sense — every mechanism being abused already existed for a legitimate purpose. What changed is that this entire toolkit, once the province of a handful of Russian state operators, is now available to any buyer with $289 a month and a Telegram account, which means the actual bottleneck on how much of this activity the world sees is no longer technical sophistication. It's simply how many people are willing to pay the subscription fee.