MadApe phishing kit turns Microsoft device-code sign-in into a route to account access

A phishing operation dubbed MadApe tricks people into completing Microsoft’s legitimate device-code sign-in flow, potentially handing attackers access to their accounts. Group-IB says it identified 155 root domains in the campaign’s infrastructure, with phishing components observed on 97 of them.

Watch Desk analysis

What happened

In a report published on 29 October, Group-IB describes a chain beginning with business-themed PDF lures. Links lead through redirect pages to fake document-sharing sites, which display a device code and direct the recipient to Microsoft’s real device-login page. The phishing pages record when a victim uses the code; the victim then completes authentication on Microsoft’s site.

Group-IB says the pages imitate services including SharePoint, OneDrive, Teams, Adobe Acrobat and DocuSign, while sharing a device-code workflow. The researchers call the kit MadApe, after finding that name on an operator-panel login page. They describe it as previously undocumented.

Read Group-IB’s investigation.

Why it matters

A real Microsoft sign-in page is not proof that the journey leading to it is safe. This attack uses a familiar business-document lure to persuade people to complete authentication themselves, rather than simply asking them to hand over a password on a fake login form.

The reported infrastructure shows the campaign is not confined to one lookalike page. Its templates can vary the branding and redirect destination while keeping the underlying flow, making visual familiarity a poor comfort blanket.

Our read

The practical warning is specific: do not enter a device code on a sign-in page just because a document link or sharing prompt told you to. Verify the request through a trusted route, and organisations should make sure staff know how to report unexpected authentication prompts. A legitimate destination can still be the last step in an attacker’s plan.

What to watch

• Whether Microsoft or other security researchers identify further infrastructure or victims.
• Whether the reported kit remains active or its domains are disrupted.
• How organisations adapt staff guidance and monitoring for device-code sign-in attempts.

Discussion spark: Should organisations restrict device-code sign-in by default, or is training people to spot suspicious prompts the better balance?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.