MadApe is a phishing kit documented by Group-IB (published 2026-10-29; the article's key-dates text says 2026-10-28) that targets Microsoft 365 / Entra ID accounts through device code phishing. The user never types a password into a counterfeit page. Instead the victim is persuaded to enter an attacker-supplied device code on the genuine Microsoft device login portal, which authorizes an attacker-controlled application and issues it access tokens. Because authentication happens on a legitimate Microsoft domain, credential-harvesting page detection and many MFA controls do not trigger.

Attack chain: a phishing email carries a business-themed PDF lure (SharePoint-styled; payment reports, invoices, contracts, proposals, account statements, voicemail notifications). The PDF links to a configurable intermediary redirect page presented as a 'Secure Document Access - SharePoint' portal, with JavaScript-embedded target URLs and a loading overlay, which lets the operator rotate downstream destinations without changing templates. A custom client-side human-verification gate follows (CAPTCHA variants, image selection, press-and-hold), with cookie-based session handling, no external library dependencies and randomized challenge types per visit. The Device Code phishing page then displays a dynamically injected Microsoft device code impersonating SharePoint, OneDrive, Teams, Adobe Acrobat, DocuSign or a Microsoft sign-in page. A cc() function copies the code to the clipboard and notifies the backend at /api/code/entered; an 'Open File' button sends the victim to microsoft.com/devicelogin. The backend polls Microsoft's token endpoint server-side, and /api/code/status/<ID> is polled by the page so it can redirect the victim once authentication completes. Backend numeric identifiers observed incrementing across requests (4024, 4026, 4029, 4031, 4033, 4036) are described as tracking records, not confirmed compromises.

Anti-analysis: right-click suppression, blocking of F12 / Ctrl+Shift+I/J/C / Ctrl+U, and client-side verification gates that stop automated scanners. Decoy sites (a 'C2S Logistics' business template and variants for industrial services, technology and real estate that share identical HTML, class names and stylesheets) are hosted on the same infrastructure. Third-party compromised hosts supplemented operator-registered domains.

Infrastructure: a dataset of 155 root domains, with phishing components on 97 and 58 staged but unused at analysis time. Dynadot registered 133 of 154 domains (86.4%); 105 of 152 domains (69%) shared identical WHOIS creation timestamps, the largest batch being 10 domains at 2026-08-18 23:48:21 UTC. Registrations concentrated June-August 2026, peaking in the week of 17 August (26 domains) and continuing into October. Primary hosting is ASGHOSTNET GmbH (Germany, AS12586) with Cloudflare in front; one example IP is 5.230.194.87. Subdomains (167 observed) often embed organization or individual names (109, 65%) or security/service terms (51, 31%), with recurring cgi-/otp- prefixes and -ox/-oi suffixes. A 'Mad Ape - Login' operator panel was found on itencrypted.co, householdwares.co, liva-fit.com, uouso.net and wbconnecticut.net, on the same infrastructure as the phishing and decoy pages; the earliest panel instance was seen on 2026-08-19. The report points to a single operator and names no actor, campaign or victims.

Post-compromise: the report notes that stolen tokens could enable mailbox access, SharePoint/OneDrive downloads, OAuth consent grant abuse, device registration, Primary Refresh Token issuance, inbox rules, forwarding configuration and onward phishing from compromised accounts. These are potential follow-on abuses, not observed activity. Hebrew-language lures were identified first; targeting includes Israel and multinational organizations across financial services, healthcare, logistics, technology and real estate. Group-IB supplied two YARA rules (GIB_MadApe_Phishing_Page, GIB_MadApe_Verification_Gate). Severity is an analyst judgement. Independent corroboration of the MadApe name was not found; facts come from the Group-IB article, with device-code-flow context from Microsoft and press sources.