A phishing kit that never asks for a password is taking over Microsoft 365 accounts by persuading victims to sign in on Microsoft's own, legitimate login page. Group-IB's Threat Intelligence team calls the kit MadApe, after the name it gives itself on its operator panel, and has mapped 155 root domains in its wider infrastructure, with device code phishing components on 97 of them.
Group-IB detailed the campaign in the original report. Device code phishing has been used by several actors and kits before, but Group-IB found no public reporting on this kit or its infrastructure and assesses it as distinct and previously undocumented.
The victim does the logging in
Device code authentication is the flow used to sign in on devices without a proper keyboard, such as smart TVs: the device shows a short code, and the user enters it at microsoft.com/devicelogin on another screen. Whoever requested the code receives the access. MadApe's backend requests the code from Microsoft and shows it to the victim on a fake page, so when the victim pastes it into the real Microsoft portal and signs in, the session goes to the attacker.
The chain starts with an email carrying a business-themed PDF made to look like a SharePoint file-sharing notice. Its link leads to an intermediary page, either a SharePoint-styled document-access page or a human-verification check, which forwards to the phishing page. Clicking the displayed code copies it and reports the click to the backend at /api/code/entered, and an Open File button sends the victim to Microsoft's genuine Device Login portal.
Many disguises, one engine
The templates impersonate SharePoint, OneDrive, Microsoft Teams, Adobe Acrobat, DocuSign and Microsoft sign-in pages, but share the same JavaScript functions and backend API endpoints, which is why Group-IB treats them as front ends of one reusable framework. The intermediary redirectors are configurable, letting the operator swap the downstream page if one is flagged or taken down. Several were planted in folders on established third-party websites that Group-IB assesses as likely compromised.
Lures appear in at least nine languages (English, Hebrew, German, Portuguese, French, Spanish, Polish, Finnish and Icelandic), with file names about payments, invoices, contracts and account statements. The Hebrew-language emails, the first Group-IB found, target recipients in Israel. Group-IB stresses that organization names seen in lures and subdomains are intended targets, not confirmed compromises, and that a sequential backend counter it observed counts records, not victims. The pages also try to block right-click and browser developer-tool shortcuts.
Block the device code flow where nobody needs it
Because the sign-in happens on a real Microsoft domain, URL checks and password hygiene do not stop this attack. Most organizations have few legitimate uses for device code sign-in, and Microsoft Entra Conditional Access can restrict or block that authentication flow. Security teams should also review sign-in logs for device code authentications that users did not expect, and teach staff that a shared document should never ask them to copy a code into a Microsoft login page.
MadApe surfaces about a month after Microsoft disrupted EvilTokens, another device code phishing operation. Taking one kit down has not retired the technique.
Indicators of compromise
- Redirect destination: hxxps://securelogin[.]qimmxn[.]icu
- Backend paths: /api/code/entered and /api/code/status/<ID>
- Intermediary page title: "Secure Document Access - SharePoint"
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.