Executive Summary
Group-IB researchers have identified MadApe, a previously undocumented phishing kit specifically designed to abuse the Microsoft Device Code authentication flow. The campaign bypasses traditional credential harvesting by leveraging legitimate Microsoft infrastructure (microsoft[.]com/devicelogin) to complete authentication. Victims are targeted with localized business-themed PDF lures (SharePoint, OneDrive, and Teams) that lead through a multi-stage redirect chain and human-verification challenges to an attacker-controlled page presenting a dynamically generated Device Code.
The technical sophistication of MadApe lies in its modular infrastructure, featuring 155 root domains, decoy business websites (e.g., C2S Logistics), and a dedicated operator panel for campaign management. By moving the authentication step to a trusted Microsoft domain, the kit effectively evades many URL-based security controls and can satisfy Multi-Factor Authentication (MFA) requirements if the victim proceeds with the authorization. The campaign remains active, with significant infrastructure expansion observed through bulk domain registrations and localized content targeting at least nine different languages.