MadApe is a sophisticated multi-stage phishing campaign targeting Microsoft Device Code authentication. It uses business-themed PDF lures, configurable redirect chains, and fake document-sharing pages impersonating services like SharePoint, OneDrive, Teams, Adobe Acrobat, and DocuSign. The campaign abuses Microsoft's Device Code flow to access victim accounts without credential theft on phishing pages. It features extensive infrastructure with 155 domains, human-verification challenges, decoy sites, and exposed operator panels. The campaign is localized in at least nine languages and focuses on business communications.
