MadApe: The Code That Opens the Door

MadApe is a sophisticated multi-stage phishing campaign targeting Microsoft Device Code authentication. It uses business-themed PDF lures, configurable redirect chains, and fake document-sharing pages impersonating services like SharePoint, OneDrive, Teams, Adobe Acrobat, and DocuSign. The campaign abuses Microsoft's Device Code flow to access victim accounts without credential theft on phishing pages. It features extensive infrastructure with 155 domains, human-verification challenges, decoy sites, and exposed operator panels. The campaign is localized in at least nine languages and focuses on business communications.

• SkyW4lker Phishing Kit: Microsoft 365 Threat to US FirmsMalware2026-10-27
• M365 Token Spray and Replay Campaign Compromises Business Email AccountsCampaign2026-10-22
• Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 AccountsMalware2026-10-20
• Active Cloud Data Theft and Extortion Campaign Targeting Microsoft 365 and SaaS PlatformsCampaign2026-09-10
• Tracking BigBear 2.0 Evilginx2 Phishing CampaignCampaign2026-09-07