# MadApe: Previously Undocumented Microsoft Device Code Phishing Kit Using Business-Themed PDF Lures and Fake Document-Sharing Pages

> Group-IB documents MadApe, a previously undocumented phishing kit that abuses the Microsoft OAuth 2.0 device code flow: business-themed PDF lures lead through redirect pages and human-verification gates to fake SharePoint/OneDrive/Teams/Adobe/DocuSign pages that show a device code and send the victim to the legitimate microsoft.com/devicelogin portal, so the operator's application receives the victim's tokens. Lures were seen in nine languages (Hebrew first identified), and the infrastructure spans 155 root domains tied to a single operator.

- **Published:** 2026-10-29T07:52:43Z
- **Last reviewed:** 2026-10-29T07:52:43Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4714
- **ID:** TL-2026-4714
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

MadApe is a phishing kit documented by Group-IB (published 2026-10-29; the article's key-dates text says 2026-10-28) that targets Microsoft 365 / Entra ID accounts through device code phishing. The user never types a password into a counterfeit page. Instead the victim is persuaded to enter an attacker-supplied device code on the genuine Microsoft device login portal, which authorizes an attacker-controlled application and issues it access tokens. Because authentication happens on a legitimate Microsoft domain, credential-harvesting page detection and many MFA controls do not trigger.

Attack chain: a phishing email carries a business-themed PDF lure (SharePoint-styled; payment reports, invoices, contracts, proposals, account statements, voicemail notifications). The PDF links to a configurable intermediary redirect page presented as a 'Secure Document Access - SharePoint' portal, with JavaScript-embedded target URLs and a loading overlay, which lets the operator rotate downstream destinations without changing templates. A custom client-side human-verification gate follows (CAPTCHA variants, image selection, press-and-hold), with cookie-based session handling, no external library dependencies and randomized challenge types per visit. The Device Code phishing page then displays a dynamically injected Microsoft device code impersonating SharePoint, OneDrive, Teams, Adobe Acrobat, DocuSign or a Microsoft sign-in page. A cc() function copies the code to the clipboard and notifies the backend at /api/code/entered; an 'Open File' button sends the victim to microsoft.com/devicelogin. The backend polls Microsoft's token endpoint server-side, and /api/code/status/<ID> is polled by the page so it can redirect the victim once authentication completes. Backend numeric identifiers observed incrementing across requests (4024, 4026, 4029, 4031, 4033, 4036) are described as tracking records, not confirmed compromises.

Anti-analysis: right-click suppression, blocking of F12 / Ctrl+Shift+I/J/C / Ctrl+U, and client-side verification gates that stop automated scanners. Decoy sites (a 'C2S Logistics' business template and variants for industrial services, technology and real estate that share identical HTML, class names and stylesheets) are hosted on the same infrastructure. Third-party compromised hosts supplemented operator-registered domains.

Infrastructure: a dataset of 155 root domains, with phishing components on 97 and 58 staged but unused at analysis time. Dynadot registered 133 of 154 domains (86.4%); 105 of 152 domains (69%) shared identical WHOIS creation timestamps, the largest batch being 10 domains at 2026-08-18 23:48:21 UTC. Registrations concentrated June-August 2026, peaking in the week of 17 August (26 domains) and continuing into October. Primary hosting is ASGHOSTNET GmbH (Germany, AS12586) with Cloudflare in front; one example IP is 5.230.194.87. Subdomains (167 observed) often embed organization or individual names (109, 65%) or security/service terms (51, 31%), with recurring cgi-/otp- prefixes and -ox/-oi suffixes. A 'Mad Ape - Login' operator panel was found on itencrypted.co, householdwares.co, liva-fit.com, uouso.net and wbconnecticut.net, on the same infrastructure as the phishing and decoy pages; the earliest panel instance was seen on 2026-08-19. The report points to a single operator and names no actor, campaign or victims.

Post-compromise: the report notes that stolen tokens could enable mailbox access, SharePoint/OneDrive downloads, OAuth consent grant abuse, device registration, Primary Refresh Token issuance, inbox rules, forwarding configuration and onward phishing from compromised accounts. These are potential follow-on abuses, not observed activity. Hebrew-language lures were identified first; targeting includes Israel and multinational organizations across financial services, healthcare, logistics, technology and real estate. Group-IB supplied two YARA rules (GIB_MadApe_Phishing_Page, GIB_MadApe_Verification_Gate). Severity is an analyst judgement. Independent corroboration of the MadApe name was not found; facts come from the Group-IB article, with device-code-flow context from Microsoft and press sources.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1684.001 Impersonation
- T1480 Execution Guardrails
- T1528 Steal Application Access Token
- T1550.001 Application Access Token
- T1583.001 Domains
- T1584.004 Server
- T1608.005 Link Target

## Sources

- [MadApe: The Code That Opens the Door (Group-IB)](https://www.group-ib.com/blog/madape-microsoft-device-code-phishing-kit/)
- [Storm-2372 conducts device code phishing campaign (Microsoft Threat Intelligence)](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/)
- [Block authentication flows with Conditional Access policy (Microsoft Learn)](https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-authentication-flows)
- [Device code phishing attacks surge 37x as new kits spread online (BleepingComputer)](https://www.bleepingcomputer.com/news/security/device-code-phishing-attacks-surge-37x-as-new-kits-spread-online/)
- [EvilTokens made phishing-as-a-service look easy. Then it got taken down (Security Affairs)](https://securityaffairs.com/199593/cyber-crime/eviltokens-made-phishing-as-a-service-look-easy-then-it-got-taken-down.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4714