---
title: Hunt: MadApe, a new Microsoft device-code phishing kit on 155 domains that walks victims to the real microsoft.com/devicelogin; look for /api/code/entered and device-code sign-ins after PDF clicks | ctxsec
url: https://ctxsec.com/items/hunt-group-ib-madape-device-code-kit-155-domains
description: ""
status: "vendor research (Group-IB, Oct 29); single operator assessed, no named actor or confirmed victims"
published: 2026-10-29
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-group-ib-madape-device-code-kit-155-domains.md)

vendor research (Group-IB, Oct 29); single operator assessed, no named actor or confirmed victims

2026-10-29

### Hunt: MadApe, a new Microsoft device-code phishing kit on 155 domains that walks victims to the real microsoft.com/devicelogin; look for /api/code/entered and device-code sign-ins after PDF clicks

Group-IB describes a kit it calls MadApe (named after its own "Mad Ape - Login" operator panel). A business-themed PDF lure (payment report, invoice, contract) links to a SharePoint-style "Secure Document Access" redirector or a custom CAPTCHA gate, then to a fake SharePoint, OneDrive, Teams, Adobe or DocuSign page that shows a live device code and sends the victim to Microsoft's genuine device login. No password is typed into a fake page, and MFA is satisfied on Microsoft's side.

- **Scale:** 155 root domains (phishing components on 97, 58 staged), 86% registered through Dynadot, mostly June to August 2026 and still growing in October; lures in nine languages, Hebrew first.
- **Web artifacts:** page JavaScript posts the code to `/api/code/entered` and polls `/api/code/status/`; a `cc()` copy-to-clipboard handler; page titles "Secure Document Access - SharePoint"; a "C2S Logistics" decoy site template on the root domains; CAPTCHA gate cookie `_cv=1`. Group-IB publishes two YARA rules (GIB_MadApe_Phishing_Page, GIB_MadApe_Verification_Gate) and full domain, URL and PDF-hash lists.
- **Infrastructure:** early panel on 5.230.194[.]87 (AS12586, ASGHOSTNET, Germany), others behind Cloudflare; some redirectors sit on compromised legitimate sites.

**Hunt:** in Entra sign-in logs filter Authentication Protocol = device code and look for users who do not normally use it, especially right after a PDF link click in email telemetry. For hits, check new device registrations, OAuth consents, inbox rules and MailItemsAccessed. **Fix:** block device code flow with Conditional Access except for documented devices (see our Oct 14 tip).

Sources: [Group-IB: MadApe, the code that opens the door (Oct 29)](https://www.group-ib.com/blog/madape-microsoft-device-code-phishing-kit/) · [Microsoft Learn: Block authentication flows with Conditional Access](https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-authentication-flows)