ThreatRoundup
High 4 Hunt LeadsYARAIOCsGroup-IB

MadApe Phishing Hands You a Code, Microsoft Hands Over Your Account

Group-IB details MadApe, a Microsoft device code phishing kit on 155 domains that sends victims to Microsoft's real sign-in page and walks off with their tokens, MFA included.

ThreatRoundup · · 12 min read

A phishing kit that Group-IB calls MadApe never asks for a password. It shows the victim a short code, copies it to their clipboard and sends them to Microsoft’s real microsoft.com/devicelogin page, where the victim signs in and approves the attacker’s session themselves. In its write-up, Group-IB says it mapped 155 root domains tied to the kit, with lures in at least nine languages and Hebrew-language emails aimed at Israel. It’s the latest device code kit after SkyW4lker and KeyStealth.

For defenders

How it works: a PDF “payment report” or SharePoint-style share notice (T1566.001 (Phishing: Spearphishing Attachment)) links to a redirect page, sometimes behind a homemade CAPTCHA that only sets a _cv=1 cookie. The phishing page pulls a live device code from the backend, copies it with a cc() function, reports the click to /api/code/entered, then opens Microsoft’s device login. The backend polls Microsoft’s token endpoint and walks off with access and refresh tokens (T1528 (Steal Application Access Token)). Group-IB notes the sign-in can satisfy MFA, because the victim completes it.

Infrastructure: mostly fresh domains, 133 of 154 registered through Dynadot, 117 of them between mid-June and late August, many with matching .net/.co/.biz twins (T1583.001 (Acquire Infrastructure: Domains)). Nine hacked legitimate sites also hosted redirect pages. Subdomains often use cgi- and otp- prefixes. The operator panel, titled “Mad Ape — Login”, first showed up on householdwares[.]co on Aug. 19.

Status: no operator is named and no victim count is given. Group-IB treats brand names in subdomains as intended targets, not confirmed compromises. It published two YARA rules, about 400 domains, 300+ URLs and roughly 60 SHA-1 hashes of lure PDFs.

Network
householdwares[.]co
itencrypted[.]co
wbconnecticut[.]net
liva-fit[.]com
uouso[.]net
sharedmsform[.]com
secure-docs.liveoakfarmsllc[.]net
c2slogistics[.]online
5.230.194[.]87

Web paths
/api/code/entered
/api/code/status/

What it means for you

This scam is sneaky because every page you end up typing into is genuinely Microsoft’s. You get a code, you paste it in, you sign in as usual, and that’s it: you’ve just let a stranger into your email and files, and your two-step login doesn’t stop it because you approved it yourself. The rule is simple. If a document or email asks you to enter a code at microsoft.com/devicelogin and you didn’t just start setting up a TV, printer or other device yourself, don’t.

Do this now

  1. Never enter a device code you didn’t request yourself; close the page and report the email.
  2. If you run Microsoft 365, check who actually uses the device code flow, then block it for everyone else with a Conditional Access policy (test it in report-only mode first).
  3. Search sign-in logs for device code sign-ins you can’t explain, and proxy logs for /api/code/entered.
  4. If someone entered a code, revoke their sessions and refresh tokens, and check for new inbox rules, app consents and registered devices.

Source article: MadApe: The Code That Opens the Door
Publisher: Group-IB (Mansour Alhmoud and Faraz Ali)
Published: October 29, 2026
URL: https://www.group-ib.com/blog/madape-microsoft-device-code-phishing-kit/

Executive Summary

MadApe is Group-IB’s name for a previously undocumented Microsoft device code phishing kit; the report names no operator or threat group and gives no other vendor aliases, and the kit’s own operator panel is titled “Mad Ape — Login”. Group-IB mapped 155 root domains, 97 of them carrying phishing components, with 133 of 154 registrations made through Dynadot, 117 registered between mid-June and late August 2026 and 69% sharing a same-second WHOIS creation time with another domain, plus nine compromised legitimate websites hosting redirect pages. Lures are business-themed PDFs, such as payment reports and SharePoint-style share notices, in at least nine languages (English, Hebrew, German, Portuguese, French, Spanish, Polish, Finnish and Icelandic), with Hebrew-language emails aimed at Israel and brand impersonation of SharePoint, OneDrive, Teams, Adobe Acrobat, DocuSign and Microsoft sign-in. The PDF links to an intermediary page that redirects after 500 ms or after a client-side CAPTCHA-style gate that sets a _cv=1 cookie; the phishing page then displays a device code fetched live from the backend, copies it to the clipboard via cc(), posts to /api/code/entered, and opens the legitimate microsoft.com/devicelogin portal via ne(). The victim enters the code and authenticates on Microsoft’s own infrastructure, potentially satisfying MFA, while the kit polls Microsoft’s token endpoint server-side and captures access and refresh tokens. The objective is account takeover of Microsoft 365 identities, with follow-on mailbox access, inbox rules and OAuth grants as the expected impact. Hunt leads, false positive expectations, the two published YARA rules and indicators are detailed below.

ATT&CK chain: Resource Development → Initial Access → Execution → Credential Access → Defense Evasion → Collection

Hunt Lead Grid

Hunt Lead Level Hunt Lead Name ATT&CK Risk of False Positives
1 (Junior) MadApe Infrastructure and Lure Sweep T1566.001 (Phishing: Spearphishing Attachment), T1583.001 (Acquire Infrastructure: Domains) Low. The domains and lure PDF hashes are kit-specific; the compromised third-party sites host legitimate content too, so hits on those anchor on the dedicated redirect directory path rather than the bare domain.
1 (Junior) MadApe Page and Verification Gate YARA T1204.001 (User Execution: Malicious Link) Low. Legitimate pages rarely combine microsoft.com/devicelogin with /api/code/entered; the rules anchor on those kit-specific endpoint and cookie strings rather than on Microsoft branding.
2 (Pro) Device Code Kit API Calls in Web Logs T1204.001 (User Execution: Malicious Link), T1528 (Steal Application Access Token) Medium. Generic paths such as /api/code/status/ can appear in legitimate web apps, so the rule anchors on a POST to /api/code/entered on a newly registered or uncategorized domain followed by a visit to microsoft.com/devicelogin.
3 (Elite) Unexpected Device Code Sign-In After a PDF Link T1528 (Steal Application Access Token), T1550.001 (Use Alternate Authentication Material: Application Access Token), T1564.008 (Hide Artifacts: Email Hiding Rules) Medium. Conference-room devices, CLI tools and some admins legitimately use the device code flow, so this needs an inventory of expected device code users and correlation with a preceding link click and token use from a different IP.

MadApe Infrastructure and Lure Sweep

MadApe operators registered most of their domains in bulk through Dynadot from mid-June to late August 2026, often pairing a .com with a .net, .co or .biz twin on the same day, and fronted them with a generic corporate decoy template (one example poses as “C2S Logistics — Global Supply Chain Solutions”). Phishing components sit on subdomains with cgi- or otp- prefixes and -ox/-oi suffixes, or in otp_ directories, and nine compromised legitimate sites, including kolkatafullmarathon[.]com and beornotbe[.]com, host redirect pages in dedicated folders. The operator panel appeared on at least five domains: itencrypted[.]co, householdwares[.]co, liva-fit[.]com, uouso[.]net and wbconnecticut[.]net, the earliest on householdwares[.]co on Aug. 19, 2026 at 5.230.194[.]87 (AS12586, ASGHOSTNET GmbH, Germany); others sit behind Cloudflare. The lure PDFs carry names like copy invoice.pdf, Zahlungsbericht.pdf, Zahlungsavis.pdf and Hebrew equivalents of “payment report” and “payment confirmation”. The detection logic is a retrospective match of the published domains and URLs in DNS, proxy and email URL-rewrite logs, the IP in firewall logs, and the SHA-1 lure hashes in email gateway attachment logs and EDR file telemetry, plus a pattern search for cgi-/otp- subdomain labels on domains first seen after June 2026.

Pull the complete domain, URL and SHA-1 lists from the source article’s IOC section rather than relying on the sample here. Sweep email gateway, DNS and proxy logs back to June 1, 2026, which covers the registration window. The compromised third-party sites are legitimate businesses, so match their full redirect paths, not the bare domain, and do not blanket-block them; the Cloudflare-fronted panel domains share IPs with unrelated sites, so treat Cloudflare IP matches as noise and anchor on hostnames. The paired-TLD habit is a useful pivot: when one domain hits, check its same-day .net/.co/.biz siblings. Any user who received a lure and then resolved a kit domain should be triaged with the sign-in lead below, since a click alone does not prove a code was entered.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Initial Access → T1566.001 (Phishing: Spearphishing Attachment); Resource Development → T1583.001 (Acquire Infrastructure: Domains), T1584.004 (Compromise Infrastructure: Server)

Sources: “MadApe: The Code That Opens the Door”, Group-IB, Oct. 29, 2026, https://www.group-ib.com/blog/madape-microsoft-device-code-phishing-kit/ (source article)

MadApe Page and Verification Gate YARA

Group-IB published two YARA rules for the kit’s front end. The phishing page rule keys on the hardcoded handoff to microsoft.com/devicelogin, the /api/code/entered and /api/code/status/ endpoints, the navigator.clipboard.writeText call and the function cc() handler. The verification gate rule keys on the exact cookie string that sets _cv=1 for 300 seconds, the 700 ms reload, the “Hold to Verify”, “Security Verification” and “Image Verification” challenge labels, and the anti-devtools check that blocks Ctrl+Shift+I/J/C. The detection logic is to run both rules over HTML and JavaScript captured by web proxies, email URL detonation or sandbox crawls, and over saved web content in browser caches during investigations.

Deploy the rules wherever full HTTP response bodies are retained: secure web gateway content inspection, URL sandbox output, or a crawler that fetches URLs extracted from inbound PDFs. Note that the verification gate rule as published declares $title = "", an empty string that YARA will refuse to compile; the value appears to have been lost in publication (it was probably an HTML title tag), so remove that string and its reference in the condition, or confirm the intended value with Group-IB, before deploying. Do not edit any other string. The rules target the front end only, so pair hits with the sign-in lead to learn whether a code was actually entered. A match on a URL a user visited is enough to start the account review in the Elite lead.

rule GIB_MadApe_Phishing_Page
{
    meta:
        author = "Group-IB Threat Intelligence"
        description = "HTML/JavaScript indicators of the MadApe Device Code phishing frontend"
        date = "2026-10-28"
        tlp = "CLEAR"

    strings:
        $api_entered = "/api/code/entered" ascii wide
        $api_status  = "/api/code/status/" ascii wide
        $device      = "microsoft.com/devicelogin" ascii wide nocase
        $clipboard   = "navigator.clipboard.writeText" ascii wide
        $handler     = "function cc()" ascii wide

    condition:
        filesize < 300KB and
        $device and
        $api_entered and
        2 of ($api_status, $clipboard, $handler)
}
rule GIB_MadApe_Verification_Gate
{
    meta:
        author = "Group-IB Threat Intelligence"
        description = "Client-side human-verification gate served ahead of the MadApe Device Code phishing page"
        date = "2026-10-28"
        tlp = "CLEAR"

    strings:
        $cookie = "document.cookie='_cv=1;path=/;max-age=300;SameSite=Lax'" ascii wide
        $reload = "setTimeout(()=>window.location.reload(),700)" ascii wide
        $title  = "" ascii wide nocase
        $hold   = "Hold to Verify" ascii wide
        $text   = "Security Verification" ascii wide
        $image  = "Image Verification" ascii wide
        $antidbg = "['I','J','C'].includes(e.key)" ascii wide

    condition:
        filesize < 100KB and $cookie and $reload and ($title or $antidbg) and 1 of ($hold, $text, $image)
}

Rules reproduced as published by Group-IB in the source article.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Execution → T1204.001 (User Execution: Malicious Link)

Sources: “MadApe: The Code That Opens the Door”, Group-IB, Oct. 29, 2026, https://www.group-ib.com/blog/madape-microsoft-device-code-phishing-kit/ (source article)

Device Code Kit API Calls in Web Logs

When the victim clicks the displayed code, the page copies it and sends a POST to /api/code/entered on the kit domain, which answers {"success":true}, then the “Open File” button opens microsoft.com/devicelogin in a new window. Group-IB also found a /api/code/status/<ID> polling loop, every five seconds, that was present but disabled in the analyzed pages. That gives a short, observable sequence from the user’s browser: a request to a newly registered or uncategorized domain, a POST to /api/code/entered, and within seconds a visit to microsoft.com/devicelogin. The detection logic is a proxy or secure web gateway rule on the POST path, raised in severity when a device login page visit from the same user follows within about two minutes.

Use web proxy, secure web gateway or browser telemetry that records URL paths and methods; DNS logs alone won’t show the path. Sweep 90 days and keep it live, since the endpoint names are baked into the kit and survive domain rotation. Scope out your own internal apps that happen to use similar API paths by allowlisting their hostnames, not the path. The status endpoint is a weaker signal because the loop was disabled, so use it to enrich rather than alert. Blocking microsoft.com/devicelogin outright is the wrong control, since it breaks legitimate device sign-ins; restrict the flow in Conditional Access instead. Any user who hit the POST and then the device login page should be treated as a probable token compromise until the sign-in logs say otherwise.

Hunt Lead Level: 2 (Pro)

ATT&CK: Execution → T1204.001 (User Execution: Malicious Link); Credential Access → T1528 (Steal Application Access Token)

Sources: “MadApe: The Code That Opens the Door”, Group-IB, Oct. 29, 2026, https://www.group-ib.com/blog/madape-microsoft-device-code-phishing-kit/ (source article)

The kit’s payoff happens entirely on Microsoft’s side: the victim types the attacker-generated code into the real device login portal and completes sign-in, MFA included, and the kit’s backend, polling Microsoft’s token endpoint, receives the access and refresh tokens. In Entra ID sign-in logs this appears as a successful sign-in whose authentication protocol is device code, typically for a client application the user has never used that way, followed by token use from the kit’s infrastructure rather than the user’s own IP. Group-IB recommends watching what happens next: inbox rule creation, MailItemsAccessed audit events and OAuth consent grants. The detection logic correlates three things per user: a device code sign-in the user doesn’t normally perform, a preceding click on a PDF-delivered URL or a kit-domain proxy hit, and, within hours, non-interactive sign-ins or mailbox access from a different IP or ASN, inbox rule creation, new app consent or new device registration.

Join Entra ID interactive and non-interactive sign-in logs, the Microsoft 365 unified audit log (New-InboxRule, Set-InboxRule, consent and device registration events, MailItemsAccessed) and proxy or email click logs in a SIEM. Start by inventorying legitimate device code use from the last 90 days, which Group-IB explicitly recommends before blocking, and allowlist those users and client apps; meeting-room devices, Azure CLI and PowerShell module users are the usual exceptions. Sweep from June 2026. Revoking a password alone is the wrong response, because refresh tokens survive it; revoke sessions and refresh tokens, and note that already-issued access tokens stay valid until they expire unless Continuous Access Evaluation applies. The detection generalizes to every device code kit, including SkyW4lker and KeyStealth. Any unexplained device code sign-in followed by off-network token use is a confirmed account compromise and should go to incident response.

Hunt Lead Level: 3 (Elite)

ATT&CK: Credential Access → T1528 (Steal Application Access Token); Defense Evasion, Lateral Movement → T1550.001 (Use Alternate Authentication Material: Application Access Token); Defense Evasion → T1564.008 (Hide Artifacts: Email Hiding Rules)

Sources: “MadApe: The Code That Opens the Door”, Group-IB, Oct. 29, 2026, https://www.group-ib.com/blog/madape-microsoft-device-code-phishing-kit/ (source article)

Hash Appendix

MadApe lure PDFs (sample)

SHA-1 values come from the source article, which lists about 60 lure hashes; a labelled sample is below and the full list is in the article’s IOC section. The source publishes no MD5 or SHA-256 values; AlienVault OTX and VirusTotal were not queried in this run.

MD5s
(not available)  # copy invoice.pdf -> MadApe lure PDF (English)
(not available)  # Zahlungsbericht.pdf -> MadApe lure PDF (German)
(not available)  # Zahlungsavis.pdf -> MadApe lure PDF (German)
(not available)  # עותק תשלום.pdf -> MadApe lure PDF (Hebrew, "payment copy")
(not available)  # הודעת תשלום.pdf -> MadApe lure PDF (Hebrew, "payment notice")
(not available)  # אישור תשלום.pdf -> MadApe lure PDF (Hebrew, "payment confirmation")
SHA1s
f0ee455b8e7ea709de27ee4111c145da546ec337  # copy invoice.pdf -> MadApe lure PDF (English)
79b46af742a2f263b76d0fdff59b795b95ba0fbe  # Zahlungsbericht.pdf -> MadApe lure PDF (German)
e5b0fefbf5d47f4ae667bd7500f079f6de368b82  # Zahlungsavis.pdf -> MadApe lure PDF (German)
e9621f90091b56c712858a27d3a775cde21c6463  # עותק תשלום.pdf -> MadApe lure PDF (Hebrew, "payment copy")
f5e9d8ed0a057fbb168bc17ad2ed1faeecae184b  # הודעת תשלום.pdf -> MadApe lure PDF (Hebrew, "payment notice")
c5f618e32c389016adff85168bb0a1b263e6975d  # אישור תשלום.pdf -> MadApe lure PDF (Hebrew, "payment confirmation")
SHA256s
(not available)  # copy invoice.pdf -> MadApe lure PDF (English)
(not available)  # Zahlungsbericht.pdf -> MadApe lure PDF (German)
(not available)  # Zahlungsavis.pdf -> MadApe lure PDF (German)
(not available)  # עותק תשלום.pdf -> MadApe lure PDF (Hebrew, "payment copy")
(not available)  # הודעת תשלום.pdf -> MadApe lure PDF (Hebrew, "payment notice")
(not available)  # אישור תשלום.pdf -> MadApe lure PDF (Hebrew, "payment confirmation")

References Appendix

  • “MadApe: The Code That Opens the Door”, Group-IB, Oct. 29, 2026, https://www.group-ib.com/blog/madape-microsoft-device-code-phishing-kit/ (source article; kit mechanics, infrastructure, YARA rules, IOCs, recommendations)
  • MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/

More from the Roundup