Group-IB details MadApe phishing kit that abuses Microsoft Device Code login

Group-IB published research on October 29 describing MadApe, a phishing kit it says has not been documented publicly before. The kit abuses Microsoft's Device Code authentication flow to reach Microsoft 365 accounts without collecting a password on any attacker-controlled page.

The chain starts with an email carrying a PDF attachment dressed up as a business document. The PDF holds a link to an intermediary page, either a SharePoint-themed document-access screen or a human-verification challenge, and both lead to the same phishing page. That page shows a device code and tells the recipient to copy it. Clicking the code copies it to the clipboard and reports the interaction to the phishing backend. The victim is then sent to Microsoft's legitimate Device Login portal to paste the code and sign in.

Group-IB says the templates impersonate SharePoint, OneDrive, Teams, Adobe Acrobat, DocuSign and Microsoft sign-in pages while sharing one Device Code workflow, and that shared JavaScript functions and backend API endpoints tie the visually different pages to a reusable framework. The researchers report 155 root domains in their expanded dataset, with Device Code components seen on subdomains or paths tied to 97 of them. The kit names itself on an operator panel login page hosted alongside the phishing and decoy sites.

Because authentication finishes on Microsoft's own infrastructure, a page that looks right is not proof of safety. Defenders should treat unexpected device code prompts as suspicious, review sign-in logs for device code authentication, and train staff to question unsolicited document links.