Group-IB describes a kit it calls MadApe (named after its own "Mad Ape - Login" operator panel). A business-themed PDF lure (payment report, invoice, contract) links to a SharePoint-style "Secure Document Access" redirector or a custom CAPTCHA gate, then to a fake SharePoint, OneDrive, Teams, Adobe or DocuSign page that shows a live device code and sends the victim to Microsoft's genuine device login. No password is typed into a fake page, and MFA is satisfied on Microsoft's side.

• Scale: 155 root domains (phishing components on 97, 58 staged), 86% registered through Dynadot, mostly June to August 2026 and still growing in October; lures in nine languages, Hebrew first.
• Web artifacts: page JavaScript posts the code to /api/code/entered and polls /api/code/status/; a cc() copy-to-clipboard handler; page titles "Secure Document Access - SharePoint"; a "C2S Logistics" decoy site template on the root domains; CAPTCHA gate cookie _cv=1. Group-IB publishes two YARA rules (GIB_MadApe_Phishing_Page, GIB_MadApe_Verification_Gate) and full domain, URL and PDF-hash lists.
• Infrastructure: early panel on 5.230.194[.]87 (AS12586, ASGHOSTNET, Germany), others behind Cloudflare; some redirectors sit on compromised legitimate sites.

Hunt: in Entra sign-in logs filter Authentication Protocol = device code and look for users who do not normally use it, especially right after a PDF link click in email telemetry. For hits, check new device registrations, OAuth consents, inbox rules and MailItemsAccessed. Fix: block device code flow with Conditional Access except for documented devices (see our Oct 14 tip).