A new phishing kit dubbed ‘MadApe’ has been abusing Microsoft’s device code sign-in to reach Microsoft 365 accounts, and it never asks victims to type a password into a spoofed page.
Group-IB’s Threat Intelligence team detailed the kit in research published Oct. 29, assessing it as distinct from device code phishing kits reported before. The name comes from the kit’s operator panel, where the login page is titled “Mad Ape.”
The attack starts with a PDF attachment made to look like a SharePoint file-sharing notice, with names referring to payments, invoices and contracts. Its link passes through an intermediary page, either a SharePoint-style document portal or a custom human-verification challenge that keeps automated scanners from reaching the final stage.
The phishing page then shows a device code and sends the victim to Microsoft’s legitimate device login portal to enter it, so the sign-in itself takes place on Microsoft’s infrastructure.
Once the victim approves the request, and if the organization’s policies permit it, the attacker’s client is issued an access token, sometimes with a refresh token as well. Because the victim completes the sign-in themselves, Group-IB said it may also satisfy MFA checks.
Templates impersonate SharePoint, OneDrive, Microsoft Teams, Adobe Acrobat and DocuSign, and lures appear in at least nine languages, including Hebrew-language emails aimed at recipients in Israel.
Group-IB Tracks 155 Domains and Urges Device Code Limits
Group-IB identified 155 root domains, with phishing components on 97 of them. Of the 154 registered in 2026, 117 were registered between mid-June and late August and 133 through a single registrar.
The earliest operator panel Group-IB saw appeared on Aug. 19, and the campaign was still registering domains in October.
Group-IB tied the infrastructure to one operator through overlapping traits, including shared code, decoy websites and registration patterns, though it acknowledged that none of those clues would prove the link by itself. It said its figures count infrastructure and backend records, not victims.
Group-IB recommended inventorying legitimate device code use in Microsoft Entra sign-in logs, testing restrictions in report-only mode and then blocking the flow through Conditional Access where it is not needed. Because blocking new sign-ins may not cut off access already granted, Group-IB said responders should revoke sessions and refresh tokens when containing an incident.
It also advised correlating device code sign-ins with clicks from PDF lures, new inbox rules and new OAuth consent grants, and said users should treat unexpected requests to enter a device code as suspicious.
