Mansour Alhmoud

APT Research Team Leader

Faraz Ali

APT Analyst

MadApe: The Code That Opens the Door

Group-IB uncovers MadApe, a previously undocumented Microsoft Device Code phishing kit that uses business-themed PDF lures, configurable redirects and fake document-sharing pages to trick victims into completing Microsoft Device Code authentication across a broad infrastructure cluster.

October 29, 2026 · min to read · Threat Intelligence

Device Code Phishing

MadApe

Microsoft 365

Microsoft SharePoint

Phishing

Social Engineering

Introduction

Group-IB Threat Intelligence team has identified a multi-stage phishing campaign abusing Microsoft Device Code authentication to gain access to victim Microsoft accounts. Rather than relying on conventional credential-harvesting pages, the campaign combines business-themed PDF lures, multi-stage redirect chains, and impersonated document-sharing services with Microsoft’s legitimate Device Login portal to complete the authentication flow.

Microsoft Device Code phishing has previously been documented across multiple threat actors and phishing kits, including implementations using dynamically generated codes and document-sharing lures. We did not find the phishing kit–tracked here as MadApe–or its infrastructure described in any such public reporting, and thus assess it as a distinct, previously undocumented kit. This investigation examines the delivery chain, infrastructure relationships, and shared frontend implementation observed in the analyzed activity, including an expanded dataset of 155 root domains and phishing components associated with 97 of them.

Key discoveries

A multi-stage phishing campaign abusing Microsoft Device Code authentication to reach Microsoft 365 accounts without collecting a password on any phishing page.
A configurable delivery chain combines business-themed PDF attachments, localized document lures, and intermediary redirect pages that can be pointed at different downstream destinations.
Phishing templates impersonate Microsoft SharePoint, OneDrive, Microsoft Teams, Adobe Acrobat, DocuSign, and Microsoft sign-in pages while sharing one Device Code workflow.
The kit–tracked as MadApe–names itself on its own operator panel login page, which is exposed on the same hosts that serve the phishing pages and the decoy websites.
The phishing pages record interaction with the supplied code and hands the victim off to Microsoft’s legitimate Device Login portal to finish authentication.
Identification of 155 root domains in the expanded infrastructure dataset, with Device Code phishing components observed on dedicated subdomains or URL paths associated with 97 of these domains.
Identification of shared JavaScript functions and backend API endpoints across visually different phishing templates, supporting the assessment that the pages are frontend variations of a reusable Device Code phishing framework.

Who may find this blog interesting:

Cyber Threat Intelligence and Threat Hunting Specialists.
Phishing and Identity Security Analysts.
Microsoft 365 and Cloud Security Teams.
Incident Responders and DFIR Teams.
Computer Emergency Response Teams (CERTs).
Corporate Security and SOC Teams.

Group-IB Threat Intelligence Portal:

Group-IB customers can access our Threat Intelligence portal for more information about the phishing kit described in this blog:

Kill Chain

Figure 1. MadApe phishing kit kill chain.

The attack begins with a phishing email containing a PDF attachment presented as a business-related document. The PDF contains an embedded link that directs the recipient to an intermediary page. In the observed deployments this is either a SharePoint-themed document-access page that redirects the browser after a click, or a human-verification challenge that serves the next stage once completed. Both lead to the same downstream phishing page.

The phishing page displays a device code and instructs the recipient to copy it before continuing. When the code is clicked, it is copied to the clipboard and the interaction is reported to the phishing backend.

The recipient is then directed to the legitimate microsoft.com/devicelogin portal, where they are instructed to paste the supplied code and authenticate with their Microsoft account. The authentication itself therefore takes place on legitimate Microsoft infrastructure, while the attacker-controlled pages are used to guide the recipient into completing the Device Code authentication flow.

Phishing Email Delivery

The messages are designed to resemble routine communications, with some incorporating organization-referencing branding, signatures, or forwarded email content to increase credibility.

The analyzed samples demonstrate that the phishing content can be localized, with Hebrew-language emails identified first during the investigation. These are a subset of the observed activity and do not reflect the full range of languages and themes used.

The examples below show representative Hebrew-language emails identified during the investigation and illustrate several delivery approaches observed within the campaign.

Figure 2a. Example of a localized payment-themed lure template.

Figure 2c. Example of a localized organization-branded lure template.

PDF Lure and Embedded Link

After opening the attachment, the recipient is presented with a PDF designed to resemble a legitimate Microsoft SharePoint file-sharing notification. The document informs the recipient that a contact has shared a file and provides a button to access the purported document.

Analysis identified multiple localized versions of this PDF template, including English, German, Portuguese, and Hebrew-language examples. Despite differences in language, document naming, and victim-facing text, the analyzed samples retained a similar SharePoint-themed layout and embedded-link delivery mechanism.

Figure 3. Examples of localized (in German, Portuguese, and Hebrew) SharePoint-themed PDF templates that preserve the underlying delivery mechanism.

Intermediary Redirect Pages

The embedded links within the PDF lures direct recipients to intermediary web pages designed to resemble secure Microsoft SharePoint document-access portals. They continue the document-sharing theme of the PDF and add one more click before the redirect.

Multiple localized versions of these intermediary pages were identified during the investigation, including Hebrew, Portuguese, German, and English-language examples. The pages retain a highly similar visual structure while varying the displayed document name, language, date, and other lure-specific content.

Figure 4. Example intermediary redirect page localization in Hebrew, Portuguese, German, and English.

Redirect Functionality

Analysis of the intermediary pages revealed JavaScript-based redirection to downstream infrastructure. The redirect destination is embedded directly within each analyzed page and varies between observed samples, indicating that the intermediary templates can be configured with different downstream destinations.

For example, one English-language sample contained:

const targetUrl =
  'hxxps://securelogin.qimmxn[.]icu?5j14dE0rNshE=cXZydw==';

When the recipient clicks the document-access button, the page displays a short loading overlay before redirecting the browser to the configured destination:

accessLink.addEventListener('click', function(event) {
    event.preventDefault();

    loadingOverlay.style.display = 'flex';

    setTimeout(function() {
        window.location.href = targetUrl;
    }, 500);
});

The intermediary pages are therefore configurable redirectors rather than phishing pages in their own right. The template stays the same while the destination, document name and business context change between samples, which lets the operator rotate downstream pages if they are flagged or taken down and route recipients to tailored phishing pages.

The MadApe Phishing Page

Analysis of a SharePoint-themed phishing page provided insight into the Device Code workflow used by the campaign. The embedded JavaScript controls the displayed Device Code, records user interaction, directs the victim to Microsoft’s legitimate authentication portal, and includes functionality for backend status tracking.

Figure 5. Example of the SharePoint-themed phishing page.

1. Device code delivery

The phishing page presents the victim with a Microsoft Device Code and instructs them to copy it before proceeding. The phishing backend obtains a Device Code from Microsoft and supplies the corresponding user code to the phishing page. The page itself does not contact Microsoft for the code; it arrives already embedded.

Repeated observations showed that the displayed code changed between requests while the phishing template remained unchanged. For example, CTQVELFRW was later replaced by GFESSDFR3, confirming that the displayed code is dynamically supplied rather than embedded as a fixed value in the template.

Figure 6. Presented Device Code is observed to be dynamically supplied rather than fixed in the phishing template.

2. Copying the code and notifying the backend

When the victim clicks the displayed Device Code, it is copied to the clipboard for use in the next step. The frontend also sends the displayed code to the

endpoint, recording the interaction with the phishing backend.

3. Redirecting to legitimate Microsoft authentication

The Open File button opens Microsoft’s legitimate Device Login portal at microsoft.com/devicelogin, where the victim is instructed to paste the supplied code and authenticate with their Microsoft account. This is a key part of the phishing technique because authentication takes place on a legitimate Microsoft domain rather than an attacker-controlled login page, making the workflow appear more trustworthy than conventional credential phishing.

Figure 7. Authentication is performed on a legitimate Microsoft Device Login page.

4. Sequential backend tracking

Analysis identified a numeric identifier (D) associated with backend status-check functionality in the phishing page. Six consecutive requests returned increasing values of 4024, 4026, 4029, 4031, 4033, and 4036, each accompanied by a different Device Code.

The JavaScript contains functionality designed to query /api/code/status/<ID> every five seconds and redirect the victim if the backend returns a captured status and a redirect destination. However, a conditional check prevented the polling loop from executing in the analyzed page instances. Separately, clicking the displayed Device Code was confirmed to send it to /api/code/entered, with the backend responding {"success":true}.

These identifiers count backend records, not confirmed victims. The frontend status loop is separate from the kit’s own polling of Microsoft’s token endpoint, which runs server side and is not visible from the page.

5. Anti-analysis functionality

The phishing page registers event handlers that attempt to suppress the context menu and common browser-inspection keyboard shortcuts, including F12, Ctrl+Shift+I/J/C, and Ctrl+U.

document.addEventListener('contextmenu',
  function(e){ e.preventDefault() });

document.addEventListener('keydown', function(e){
  if(
    e.key === 'F12' ||
    (e.ctrlKey && e.shiftKey &&
      ['I','J','C'].indexOf(e.key) > -1) ||
    (e.ctrlKey && e.key === 'u')
  ) e.preventDefault()
});

These controls make casual inspection of the phishing page more difficult, but do not prevent analysis using external tools.

Campaign Expansion and Lure Diversity

Further analysis of campaign artifacts and related infrastructure expanded the observed scope of the activity beyond the initially analyzed samples. Document names and lure content identified during this process showed broader localization and customization, with at least nine languages observed: English, Hebrew, German, Portuguese, French, Spanish, Polish, Finnish, and Icelandic.

The identified filenames primarily referenced payments, invoices, contracts, proposals, account statements, and other business documents, with some also incorporating organization-specific names or references. The analyzed Hebrew-language emails target recipients in Israel for example. Throughout this analysis, we treat organization and individual names found in subdomains, paths and lures as intended targets of the campaign, not as confirmed compromises.

Language	Observed Filename / Title
English	Payment Report 2025 – Confidential
Hebrew	דוח תשלומים 2026 – סודי
German	Zahlungsbericht 2026 – Vertraulich
Portuguese	Relatório_de_Pagamento_7667567678.pdf
French	Facture de commande aléatoire
Spanish	Factura y estado de cuenta pendientes
Polish	Aktualizacja płatności i przypomnienie o rezerwacji
Finnish	Sopimus ja maksu.docx
Icelandic	Samningssamningur og greiðsla.docx

Intermediary Infrastructure

Additional intermediary infrastructure was identified through the distinctive page titles and visual characteristics of the SharePoint-themed redirect pages. Searches for localized page titles, including “גישה מאובטחת למסמכים – SharePoint” and “Secure Document Access – SharePoint,” identified additional instances of the same or closely related redirect templates across numerous domains and URL paths.

Several intermediary pages were hosted under legitimate third-party websites. These are established websites with old registration dates and unrelated content, and the redirect pages were placed in dedicated directories alongside the legitimate site. They are likely compromised third-party hosts rather than operator-registered domains, and they are listed separately from the registration analysis for that reason.

Domain	Representative Observed Paths	Assessment
kolkatafullmarathon[.]com	/otp_folder/solid.html, /top_folder/solid.html, /otp_xl/solid.html	Third-party / potentially compromised
cenciagroindustrial[.]com[.]ar	/cgi_readme/verify.html, /otp_folder/solid.html, /oneway_pl/solid.html	Third-party / potentially compromised
a-map[.]co[.]za	/top_box/solid.html, /nofar/solid.html	Third-party / potentially compromised
beornotbe[.]com	/Elad_tech/solid.html, /files_shared/verify.html, /Document_share/verify.html	Third-party / potentially compromised
siafrique[.]co[.]zw	/Harasin_File/grab.html, /refael_bukra/verify.html, /Dresden_File/solid.html	Third-party / potentially compromised
nuris[.]gr	/wave_photonicsw/solid.html, /Docs_File/verify.html, /Yoav_Files/verify.html	Third-party / potentially compromised
smartingroup[.]com	/accounts_folders/secure.html, /Martin_Hayes/contract_sign.html	Third-party / potentially compromised
mundialsolutions[.]net	/Matan_Zaid/verify.html, /Finance_dept/verify.html	Third-party / potentially compromised
comboiobr[.]com[.]br	/Venus_Payment/secure_access.html, /Alok_Mawar/verify.html	Third-party / potentially compromised

Repeated use of individual domains was also observed, with multiple distinct campaign paths hosted beneath the same root domain. Directory names referenced document-sharing themes, financial terminology, organizations, and personal names. These path names show that lures were customized per recipient and campaign, the same pattern seen in the subdomain naming described later.

Human-Verification Challenges

Pages identified during infrastructure analysis presented human-verification challenges before serving the Device Code phishing page. Group-IB analysts observed text-based CAPTCHAs, text-entry challenges, image-selection tasks and press-and-hold controls. Repeated requests to the same URL returned different challenge types, indicating that the server selects a template at random for each visit rather than tying a challenge to a specific deployment.

We established that the challenges are custom-built and not drawn from a third-party verification service. All recovered templates share one page structure, stylesheet and completion logic, and none loads an external verification library. Each challenge is completed entirely on the client side, with no server-side check of the result. On completion, the page sets a short-lived cookie and reloads, and the server then serves the Device Code phishing page to any request carrying that cookie.

The challenge serves as an anti-analysis layer rather than a security control. It keeps automated scanners and crawlers from reaching the final stage, so that URL-reputation services and automated analysis record only the challenge page. The challenge pages also carry the same right-click and keyboard-shortcut suppression logic described in the Anti-analysis section above, confirming that the gate is a component of the same kit rather than a separate layer.

Figure 8a. Example of custom “text-based CAPTCHA” challenge page acting as an anti-analysis layer.

Figure 8b. Example of custom “press-and-hold verification” challenge page acting as an anti-analysis layer.

Figure 8c. Example of custom “image selection” challenge page acting as an anti-analysis layer.

Figure 8d. Example of custom “text-entry verification” challenge page acting as an anti-analysis layer.

Operational Phishing Infrastructure

During analysis of the Device Code phishing infrastructure, several identified root domains were observed serving the same “C2S Logistics — Global Supply Chain Solutions” website, while their subdomains and URL paths hosted the phishing pages described above. This repeated combination of identical root-domain content and Device Code phishing functionality established the C2S Logistics page as a useful infrastructure pivot.

Further investigation using Group-IB Graph identified additional relationships between domains, subdomains, IP addresses, and SSL certificates. These relationships helped expand the infrastructure investigation beyond the initially identified phishing domains. Shared hosting and certificate associations were used as pivots, and every domain reached through them was then checked against the other cluster traits described in this analysis.

Figure 9. Analysis of root domains observed to be serving the same C2S Logistics website via Group-IB Graph.

Further searches using the recurring page title and matching visual content identified additional domains serving the C2S Logistics website. The repeated decoy content, shared registration patterns, shared hosting and directly observed Device Code phishing functionality on a large subset of these domains establish the infrastructure as one cluster.

Figure 11. The C2S Logistics decoy website.

Additional Decoy Website Templates

Further infrastructure analysis identified additional domains serving business-themed websites with different branding but similar page layouts. Observed examples included industrial services, technology, software, and real estate themes.

Despite differences in branding and color, these websites are built from the same HTML template. We compared the page source of the C2S Logistics site with the other variants and found an identical document structure, the same inline stylesheet with the same class names in the same order, and the same body layout of a hero section, a three card feature grid, a mailto contact button and a footer. Only the brand name, tagline, accent color and contact address change between sites, and the business themed variants carry word for word the same filler text in all three feature cards.

This repeated structure provides an additional infrastructure pivot for identifying related domains. Because the match is at the level of the page source rather than the visual design, it ties these domains to the same operator and the same tooling as the C2S Logistics cluster. These domains also fall within the same registration batches and registrar pattern described in the following sections, and several of them serve the phishing components in their subdomains and paths. We therefore treat every site built from this template as part of the campaign infrastructure, whether it was observed serving a lure at the time of analysis or was only staged as a decoy.

Figure 12. Other identified business-themed decoy pages using the same template structure as C2S Logistics.

The expanded infrastructure dataset comprises 155 root domains. The registrar, weekly and monthly registration charts cover the 154 domains registered in 2026. The same-second registration analysis covers the 152 of those domains that carry a full WHOIS creation timestamp. Phishing-component placement was assessed across all 155 root domains.

Domain Registration Patterns

WHOIS analysis identified a concentration of domain registrations between June and August 2026. Of the 154 domains represented in the analyzed dataset, 117 were registered between mid-June and late August. The highest weekly concentration occurred during the week beginning 17 August, when 26 domains were registered.

Registration continued after August. The domains added in September and October show the same pattern: most were bought through Dynadot, the twin TLD purchasing continued with .com now paired with .biz and .online, and around half of them were already serving the phishing kit at the time of analysis. The campaign remains active and is still provisioning infrastructure in the same way.

Figure 13. Cluster registration timeline.

Registrar analysis identified a strong concentration of domains registered through Dynadot, accounting for 133 of the 154 domains (86.4%). The remaining domains were distributed across several registrars, including Namecheap and Tucows. The domains registered outside Dynadot follow the same pattern as the rest of the cluster. All of them were registered in 2026 with privacy protection and several of them host the phishing kit, so they are operator owned domains rather than compromised sites. The Tucows domains were also bought together on a single day, forming their own batch.

Figure 14. Domain registrar distribution.

Coordinated Domain Registration Patterns

Further examination of WHOIS creation timestamps identified multiple groups of domains registered at exactly the same second. Among the 152 domains that carry a full WHOIS creation timestamp, 105 (69%) shared an identical creation timestamp with at least one other domain in the dataset.

The largest observed group comprised 10 domains registered on 18 August 2026 at 23:48:21 UTC. Additional groups of eight and six domains were identified on 5 August and 26 July, respectively.

On their own, these same-second registrations show automated or bulk domain acquisition. Read together with the registrar concentration, the twin TLD buying, the shared subdomain naming convention and the shared website template described in this analysis, they place these domains in a single provisioning pipeline run by one operator.

Figure 15. Same-second registration batches.

Observed Placement of Phishing Components

Among the 155 root domains in the expanded infrastructure dataset, Device Code phishing components were observed only on dedicated subdomains for 33 domains, only at URL paths for 54 domains, and in both locations for 10 domains. In total, phishing components were observed on infrastructure associated with 97 root domains. No phishing component was identified for the remaining 58 domains during the investigation.

This separation allowed the same decoy content to be maintained at the root domain while phishing functionality was hosted on dedicated subdomains or URL paths. The 58 domains without an observed component sit in the same registration batches and serve the same decoy template as the active ones. Group-IB treats them as staged infrastructure that had not yet been put to use at the time of analysis.

Figure 16. Where the Device Code phishing components were hosted.

Infrastructure Customization

The phishing infrastructure was further customized through subdomain naming conventions. Among 167 observed subdomains across 43 root domains, 109 (65%) contained labels resembling organization or individual names, while 51 (31%) used service- or security-related terminology. The remaining seven subdomains (4%) contained opaque identifiers.

The infrastructure therefore supported both service impersonation and recipient-specific customization. A recurring naming convention also runs through the cluster: labels built from cgi- and otp- prefixes and -ox and -oi suffixes appear on 23 subdomains across multiple root domains, and the same otp_ naming appears in the directory names on the compromised third-party hosts. This observed convention is one of the traits used to tie the infrastructure together.

Figure 17. Subdomain naming patterns.

Distribution of Domain Registrations by Top-Level Domain

Analysis of domain registration patterns identified changes in the distribution of top-level domains during the observed period. July 2026 registrations were concentrated in .com and .net, while August showed increased use of .co alongside .com.

The observed infrastructure included domains sharing the same base name across different top-level domains. Of the 41 .net and .co domains, 37 were registered on the same day as their corresponding .com domain. These matching names and registration dates provide an additional relationship within the investigated cluster.

Figure 18. Paired registrations move from .com and .net to .com and .co.

Multiple Phishing Themes, Same Underlying Framework

Infrastructure analysis identified multiple phishing pages using different visual themes while retaining the same underlying Device Code workflow and backend communication logic. Observed templates impersonated Microsoft SharePoint, OneDrive, Microsoft Teams, Adobe Acrobat, DocuSign, and Microsoft authentication pages.

Despite substantial differences in branding, page layout, document context, and victim-facing instructions, comparison of the underlying JavaScript identified the same core implementation across the analyzed templates. Each page handles the displayed device code through the same cc() function, copies it to the clipboard, and submits the code to /api/code/entered using the same JSON structure. The pages also use the same ne() function to open Microsoft’s legitimate Device Login service and contain the same /api/code/status/<ID> logic for backend status tracking.

The reuse of these implementation-level artifacts across visually different phishing pages indicates that the observed themes are frontend variations of the same phishing framework rather than independently developed implementations.

The table below provides representative examples of different phishing themes using the shared framework.

Theme	Observed Infrastructure	Lure / Action
SharePoint	secure-docs.liveoakfarmsllc[.]net	Shared payment document / Open File
OneDrive	durakdisplay[.]com/7664453fe5	Shared file / Open in OneDrive
Adobe Acrobat	neottdesign[.]com/85f81154f0	Protected document / View Document
DocuSign	cumminslogistic.kemalradio[.]com	Proposal / View Document
Microsoft Teams	lvborses[.]com/f948e90ab1	Voicemail / Play voicemail
Microsoft	nxinet[.]com/d9f90ed790	Verification / Sign in

Observed Social-Engineering Templates

OneDrive

Multiple visual implementations were also observed for individual brands. For example, at least two distinct OneDrive-themed layouts were identified while retaining the same underlying Device Code functionality.

Figure 19. Examples of OneDrive-themed templates.

Adobe Acrobat and DocuSign

The framework was not limited to Microsoft-branded lures. An Adobe Acrobat-themed page presented a protected document and an access code while retaining the same underlying Device Code functionality observed across the other templates.

Additional DocuSign-themed pages were also identified elsewhere in the infrastructure, including trxid048637.haoekang[.]com, further indicating reuse of the DocuSign theme across the identified infrastructure.

Figure 20. Examples of Adobe Acrobat and Docusign-themed templates.

Microsoft Teams and Microsoft

Figure 21. Example of Microsoft and Teams-themed templates.

The social-engineering themes extended beyond document sharing. A Microsoft Teams-themed page used a German-language voicemail notification and instructed the victim to copy a supplied code and complete the Device Code authentication flow before the purported voicemail could be played.

MadApe Operator Panel

We observed the kit’s operator panel login page on at least five domains in the cluster, including itencrypted[.]co, householdwares[.]co, liva-fit[.]com, uouso[.]net and wbconnecticut[.]net. The page is titled “Mad Ape — Login”, carries the prompt “Authenticate to access your panel” and a custom ape logo, and is served from the same hosts that serve the C2S Logistics decoy and the Device Code phishing pages. The earliest instance we saw was on householdwares[.]co on 19 August 2026, hosted on 5.230.194[.]87 (AS12586, ASGHOSTNET GmbH, Germany), with other instances sitting behind Cloudflare.

Because the panel sits on the same hosts as the phishing pages and the decoy sites, we assess that all three are run as one deployment. The panel is also where the kit’s name comes from, and its page title turns out to be a useful pivot, since searching for it has surfaced hosts that the decoy template alone would not have led us to.

Figure 22. Mad Ape operator panel login page.

Conclusion

This campaign demonstrates how Device Code phishing can abuse a legitimate Microsoft authentication workflow to gain access to a victim’s Microsoft account without collecting credentials through a fake login page. By directing the victim to Microsoft’s legitimate Device Login portal, the attack moves the critical authentication step onto trusted infrastructure while the attacker-controlled phishing pages guide the victim through the authorization process.

If the victim completes authorization and applicable access controls permit token issuance, the attacker-controlled client can receive an access token for the granted permissions and, where supported and requested, a refresh token. Depending on the granted access, these tokens could enable access to Microsoft 365 resources and support follow-on activity such as mailbox or file access, data collection, and further abuse of the compromised account. The risk therefore extends beyond the initial phishing interaction, particularly because successful authentication may also satisfy MFA requirements during the legitimate Microsoft sign-in process.

The broader infrastructure demonstrates reuse of the same phishing framework across multiple deployments and social-engineering themes. Shared decoy content, consistent backend functionality, localized lures, and multiple phishing templates were observed while the underlying Device Code workflow remained largely unchanged. These findings indicate the use of a reusable Device Code phishing kit, MadApe, capable of supporting different lures, languages and target audiences, and the kit’s own operator panel, found on the same hosts, confirms that the phishing pages, decoy sites and backend belong to one deployment.

No single observation in this analysis is enough to link 155 domains to one operator, and we have not relied on any single one. The links hold because the observations overlap on the same domains. The domains registered in the same second were bought through the same registrar, carry the same twin TLD pattern, use the same cgi-, otp-, -ox and -oi subdomain naming, serve the same website template on their root, and host the same Device Code phishing kit with the same API endpoints and the same human verification gate on their subdomains and paths, and several of them also expose the MadApe operator panel. Each of these traits is a weak signal in isolation. Their repeated co-occurrence across the dataset is what establishes that the infrastructure was provisioned and operated as one campaign.

Recommendations

Device Code phishing can bypass defenses focused primarily on counterfeit login pages and credential harvesting. Defenses should therefore address Device Code authentication, suspicious token issuance, and subsequent account activity in addition to phishing URLs and email delivery.

For Identity and Microsoft 365 Administrators

Inventory legitimate Device Code use. Review Microsoft Entra sign-in logs using the Authentication Protocol filter to identify Device Code activity and document the accounts and applications that require it. Review the Original transfer method field where available to identify subsequent activity associated with an earlier Device Code session. Validate proposed restrictions in Report-only mode before enforcement.
Restrict Device Code authentication through Conditional Access. Where the flow is unnecessary, configure a policy using the Authentication flows condition, select Device code flow, and block access. After validating policy impact, enable enforcement. Limit exceptions to approved accounts and documented business requirements, preserve necessary emergency access arrangements, and review exclusions regularly. Apply and test supplementary controls for exempted accounts; excluding an account from a blocking policy also excludes it from that policy’s other conditions.
Reduce continued unauthorized access. Verify that Continuous Access Evaluation is enabled for supported applications and clients, and configure appropriate risk-based Conditional Access and sign-in frequency controls. Their effectiveness depends on application support and policy evaluation. Enabling a blocking policy should not be assumed to terminate existing access immediately: subsequent token requests may be blocked, while already-issued access tokens may remain usable until expiry or earlier rejection by the resource. Suspected compromise requires prompt session revocation and account containment.
Inspect the complete delivery chain. Analyze PDF attachments and their embedded links in an isolated environment capable of following user-interaction-dependent redirects. The observed intermediary pages require a click and a short delay, which may prevent scanners limited to the initial URL from reaching the final phishing page. Investigate Microsoft-branded document-access pages on unrelated domains and use domain age as a supplementary signal alongside redirect behavior and phishing-page characteristics.

For SOC and Threat Hunting Teams

Monitor Device Code authentication outside documented business use. Review Microsoft Entra sign-in logs for unexpected Device Code authentication events, unfamiliar applications, unusual source IP addresses, and suspicious geographic locations. Correlate these events with phishing URL access, user activity, and subsequent Microsoft 365 operations. Source IP attribution should be assessed in the context of the specific authentication event. Sign-ins involving hosting providers, anonymization services, unusual geographic locations, or known campaign infrastructure should be prioritized for further investigation and correlated with authentication and account activity.
Correlate interrupted and successful authentication events. Review Microsoft Entra sign-in logs for Device Code authentication attempts followed by successful sign-ins involving the same account or application. Examine authentication protocol details, timestamps, source IP addresses, and application identifiers to identify suspicious authentication sequences. An interrupted authentication event alone does not establish successful account compromise. Correlate these with URL clicks from email, particularly clicks originating in PDF attachments, and note which application received the token.
Hunt for network and page-content indicators using the appropriate telemetry. Search DNS logs for the listed domains and subdomains. Where full URL visibility is available, search proxy, browser, or sandbox telemetry for requests to /api/code/entered and /api/code/status/. Search captured HTML or web-scanning datasets for the “Secure Document Access – SharePoint” title, localized variants, and recurring “C2S Logistics” content. Correlate unexpected visits to microsoft.com/devicelogin with preceding phishing-page access and subsequent authentication events.
Monitor activity following suspicious authentication. Correlate Device Code sign-ins with unexpected device registrations, anomalous token use, new or modified inbox rules, unusual MailItemsAccessed events, new OAuth consent grants, bulk SharePoint or OneDrive downloads, and phishing messages sent from the account. Investigate associated device registrations as possible persistence indicators. Device registration alone does not establish that a Primary Refresh Token was obtained.

For Incident Response Teams

Investigate suspected Device Code phishing immediately. If a user entered a code supplied by an untrusted website, determine whether the associated authentication request was successfully completed. Review Microsoft Entra sign-in events, application permissions, and subsequent account activity. Where successful unauthorized authentication is confirmed or strongly suspected, initiate account containment and session revocation procedures.

Contain confirmed account compromise. Revoke active sign-in sessions and refresh tokens, investigate suspicious application access, and temporarily block sign-in where necessary. Review already-issued access tokens and account activity, as session revocation may not immediately invalidate every token. Reset credentials where password compromise is suspected or required by the incident response procedure.
Remove persistence and establish scope. Preserve relevant logs and configuration details, investigate unfamiliar device registrations and application grants, and disable or remove those identified as unauthorized. Remove malicious inbox rules and forwarding settings, and review authentication methods for unauthorized additions. Then review the sign-in history, mailbox items accessed and files downloaded during the attacker’s session, and emails sent from the mailbox; check whether the same lure reached other recipients; and search the tenant for the IOCs in this blog. Submit the phishing URLs for takedown.

For End Users

Know what a device code is for. The device authorization flow supports sign-in on devices and in applications with limited input or browser capabilities, including conferencing devices and command-line tools. Unexpected requests to enter a Device Code to access shared documents, invoices, voicemail messages, or e-signature requests should be treated as suspicious and independently verified.
Read the confirmation prompt. The legitimate page names the application requesting access and asks you to confirm. If you did not start that application on a device you control, select Cancel. A request to copy a code from an unexpected webpage and enter it into Microsoft’s sign-in portal should be treated as suspicious. Proceed only when the sign-in was deliberately initiated for a trusted application or device and the displayed application matches the expected request.
Report suspicious Device Code authentication immediately. If a code supplied by an untrusted website was entered into Microsoft’s Device Login portal, report the incident to the security team, even if no suspicious activity is immediately visible. Successful authorization may grant an attacker access without requiring the victim to disclose their password.

Indicators of Compromise (IOCs)

Network IOCs

URLs

hxxps://swisstowerant[.]com/mr98g6r
hxxps://swisstowerant[.]com/bp2j95y
hxxps://swisstowerant[.]com/4y9zvik
hxxps://swisstowerant[.]com/mzamnoq
hxxps://alliadesigns[.]co/ceb7d18802
hxxps://itencrypted[.]co/816c04559c
hxxps://itencrypted[.]com/64d32dx
hxxps://lcscenter[.]co/n5nnj8f
hxxps://householdwares[.]co/5a950b8b12
hxxps://householdwares[.]co/be692d2d96
hxxps://healthy39[.]co/k7zunh8
hxxps://healthy39[.]com/k67ip6e
hxxps://healthy39[.]com/qfmw622
hxxps://szwhtl[.]com/8545360594
hxxps://szwhtl[.]com/7cf187d1b3
hxxps://cepoffices[.]co/dr67o3b
hxxps://antaiyimin[.]com/cvx2mym
hxxps://durakdisplay[.]com/7664453fe5
hxxps://durakdisplay[.]net/4hzatas
hxxps://durakdisplay[.]net/fjstnfw
hxxps://durakdisplay[.]net/pz2jxt7
hxxps://durakdisplay[.]net/jgsure7
hxxps://durakdisplay[.]net/2yis9nr
hxxps://durakdisplay[.]net/ruo2m9n
hxxps://durakdisplay[.]net/omn5p2b
hxxps://durakdisplay[.]net/36ebjxp
hxxps://durakdisplay[.]net/reoqyb7
hxxps://neottdesign[.]com/c3bbd5214b
hxxps://neottdesign[.]com/4b47b643ac
hxxp://neottdesign[.]com/4b47b643ac
hxxps://neottdesign[.]com/b7275b506c
hxxps://neottdesign[.]com/85f81154f0
hxxps://neottdesign[.]com/9v8f5k2
hxxps://neottdesign[.]com/47ed07b1c3/
hxxps://neottdesign[.]com/95atypp
hxxps://neottdesign[.]net/g54zzhh
hxxps://neottdesign[.]net/ex5j78x
hxxps://neottdesign[.]net/kgs67yq
hxxps://neottdesign[.]net/68m7vkb
hxxps://neottdesign[.]net/6st9cyp
hxxps://kecifang[.]com/88ecaa6206
hxxps://kecifang[.]com/584fefefa4
hxxps://kecifang[.]net/787118798b
hxxps://travestiilan[.]com/789xkv3
hxxps://travestiilan[.]com/3u4m6gw
hxxps://uouso[.]net/139083e063d4a160
hxxps://liva-fit[.]net/bc97hx8
hxxps://liva-fit[.]net/xns3mg2
hxxps://liva-fit[.]net/wh52t56
hxxps://haoekang[.]com/dpppdvm
hxxps://haoekang[.]com/4huotov
hxxps://nngresearch[.]net/c5c57a09b6
hxxp://nngresearch[.]net/c5c57a09b6
hxxps://albairaqllc[.]com/tcicx4o
hxxps://albairaqllc[.]com/kqt7wgo
hxxps://nsboards[.]com/sjs9nu4
hxxps://lvborses[.]com/hn25d34
hxxps://lvborses[.]com/86b9124e19
hxxps://lvborses[.]com/a9fa6327cb
hxxps://lvborses[.]com/f948e90ab1
hxxps://opticaberl[.]com/8eeew97
hxxps://tardgvhse[.]com/c4z9j6q
hxxps://nctravelme[.]net/c0ca9b0c79
hxxps://nxinet[.]com/d9f90ed790
hxxps://innovizeltd[.]com/apkskkg
hxxps://innovizeltd[.]com/vqrqyrj
hxxps://innovizeltd[.]com/rxtzznr
hxxps://innovizeltd[.]net/89a665f9e5
hxxps://ircjunx[.]com/4b4d9175da
hxxps://ircjunx[.]com/8fe47cc01e
hxxps://sucosos[.]com/7446f72c4e
hxxps://sucosos[.]com/0cb654703b
hxxps://sucosos[.]com/44973b5ded
hxxps://sucosos[.]com/0f6e45b029
hxxps://sucosos[.]com/3864560d78
hxxps://schunk-usa[.]com/BrWsIS
hxxps://schunk-usa[.]com/N0MMIi
hxxps://schunk-usa[.]com/wt7YpF
hxxps://mahogany-records[.]com/8nh43pf
hxxps://mahogany-records[.]com/c9m8wue
hxxps://mahogany-records[.]com/9qamdzm
hxxps://mahogany-records[.]com/necgh6x
hxxps://uggsbootsoutletonlines[.]us/zu86cmz
hxxps://patousducourtaou[.]com/h4i9ja7
hxxps://patousducourtaou[.]com/3fd5c0aa24
hxxps://unitedkrew[.]com/zcwr5uu
hxxps://unitedkrew[.]com/dh7my83
hxxps://zakosta[.]info/kugyrj5
hxxps://zakosta[.]info/8huwt2p
hxxps://zakosta[.]info/dtxa8wa
hxxps://zakosta[.]info/6pwzfnv
hxxps://zakosta[.]info/aeiivd
hxxps://afkarperfumes[.]com/229nrjn
hxxps://wbconnecticut[.]net/0c603e73be
hxxp://wbconnecticut[.]net/f3c77e9507
hxxps://wbconnecticut[.]net/7549ec6037
hxxps://wbconnecticut[.]net/50cf52ba2c
hxxps://wbconnecticut[.]net/f3c77e9507
hxxps://wbconnecticut[.]net/yqv2qwv
hxxps://wbconnecticut[.]net/26da7f62f3
hxxps://boltonmassachusetts[.]us/xve6wwe
hxxps://boltonmassachusetts[.]us/p35h6wj
hxxps://boltonmassachusetts[.]us/r5fjquq
hxxps://boltonmassachusetts[.]us/prsvob9
hxxps://boltonmassachusetts[.]us/jcdn8jf
hxxps://boltonmassachusetts[.]us/ns9ow8b
hxxps://c2slogistics[.]online/udw36ea
hxxps://c2slogistics[.]online/aofvq67
hxxps://c2slogistics[.]online/aeenrnu
hxxps://immersive[.]cfd/pxy5ryq
hxxps://immersive[.]cfd/43ybyz3
hxxps://immersive[.]cfd/susoojn
hxxps://goucairen[.]com/tqpu7ye
hxxps://industryspotlightreport[.]com/tk8ge73
hxxps://excellcoatings[.]ca/6o3hf5s
hxxps://excellcoatings[.]ca/9mig4a8
hxxps://excellcoatings[.]ca/kj2vem2
hxxps://autheti[.]com/8wqhikq
hxxps://autheti[.]com/awtuyz9
hxxps://autheti[.]com/mndcedo
hxxps://autheti[.]com/msxynfc
hxxps://autheti[.]com/ndag9e6
hxxps://autheti[.]com/qdjeehg
hxxps://autheti[.]com/test
hxxps://autheti[.]com/zjb5dwm
hxxps://telesismgmt[.]com/4f92gcb
hxxps://telesismgmt[.]com/aaunvws
hxxps://telesismgmt[.]com/gnciyn8
hxxps://telesismgmt[.]com/uqjir6a
hxxps://telesismgmt[.]com/vcf2jnx
hxxps://sonicweaversinc[.]com/cho7vi6
hxxps://sonicweaversinc[.]com/jraqw9e
hxxps://sonicweaversinc[.]com/yqhh7u6
hxxps://sessivesnet[.]us/29togiv
hxxps://sessivesnet[.]us/4veszc4
hxxps://powerlivings[.]com/4o6xk2c
hxxps://pilschip[.]com/978hycr
hxxps://nysndigital[.]com/3xn7wig
hxxps://nysndigital[.]com/beibtp4
hxxps://nysndigital[.]com/gj9vp9q
hxxps://nysndigital[.]com/mvmo8v3
hxxps://nysndigital[.]com/s8xqmwj
hxxps://nysndigital[.]com/yj3937w
hxxps://cmfbadminton[.]com/sigaa3f
hxxps://adastraerrans[.]com/44w824k
hxxps://adastraerrans[.]com/szzdfgg
hxxps://jona-construction[.]com/c9osfbn
hxxps://jona-construction[.]com/h53y2a4
hxxps://jona-construction[.]com/qimyyf7
hxxps://jona-construction[.]com/t4mdeyu
hxxps://jona-construction[.]com/t8h2eiz
hxxps://planer7[.]online/vnpwr6n
hxxps://hvacpik[.]com/3nv5e6j
hxxps://hvacpik[.]com/3wwwoqn
hxxps://hvacpik[.]com/b632irp
hxxps://hvacpik[.]com/ve7rzyf
hxxps://displayresearchinc[.]org/2piireb
hxxps://displayresearchinc[.]org/5r6opm7
hxxps://displayresearchinc[.]org/84ecnbu
hxxps://displayresearchinc[.]org/ihpnymi
hxxps://displayresearchinc[.]org/v2tm6k2
hxxps://displayresearchinc[.]org/xaexe2w
hxxps://displayresearchinc[.]org/zfq5kiv
hxxps://displayresearchinc[.]org/zwps5c3
hxxps://encryptedfolder[.]com/mndcedo
hxxps://thenextplanet[.]cfd/bxsodey
hxxps://thenextplanet[.]cfd/jofc657
hxxps://thenextplanet[.]cfd/tjws69v
hxxps://thenextplanet[.]cfd/wgbqkdc
hxxps://koenig-usa[.]com/2jih3ph
hxxps://koenig-usa[.]com/2zc4bj2
hxxps://koenig-usa[.]com/8ds6p4r
hxxps://koenig-usa[.]com/9hbtf25
hxxps://koenig-usa[.]com/m5ksfw9
hxxps://koenig-usa[.]com/thzooo3
hxxps://koenig-usa[.]com/v9bbzdg
hxxps://plymouthdentist[.]co/3b9zyg5
hxxps://plymouthdentist[.]co/4ccmoa4
hxxps://plymouthdentist[.]co/a3pyhvw
hxxps://plymouthdentist[.]co/fnfgnyv
hxxps://plymouthdentist[.]co/oe33xkc
hxxps://plymouthdentist[.]co/seumz9y
hxxps://plymouthdentist[.]co/xj7baz8

Domains

goucairen[.]com
intumedias[.]com
viraltruewealth[.]com
industryspotlightreport[.]com
excellcoatings[.]ca
sharedmsform[.]com
ids1yqvhzc.sharedmsform[.]com
lizlwlanth.sharedmsform[.]com
rv0vnoqone.sharedmsform[.]com
trcxwedaxm.sharedmsform[.]com
wrtuzhgfzd.sharedmsform[.]com
autheti[.]com
form-viva[.]site
651c4138-94f4e-90784-9167-81s7528d91b4-67lc6hj[.]com
yzhrope[.]com
travelzens[.]com
telesismgmt[.]com
sonicweaversinc[.]com
american-multifamily.sonicweaversinc[.]com
seacoast5151condominium.sonicweaversinc[.]com
sessivesnet[.]us
powerlivings[.]com
planer7[.]com
pilschip[.]com
nysndigital[.]com
glamourevive[.]com
gargale-law[.]com
cmfbadminton[.]com
adastraerrans[.]com
americanfrontiermc[.]com
jona-construction[.]com
pallas-records[.]biz
planer7[.]online
pvolvestudlos[.]com
hvacpik[.]com
displayresearchinc[.]org
encryptedfolder[.]com
encryptedmforms[.]com
lcscenter[.]com
thenextplanet[.]cfd
koenig-usa[.]com
plymouthdentist[.]co
encryptedsc[.]com
americanfrontiermc[.]biz
pallas-records[.]com
tauchtechnik[.]com
swisstowerant[.]co
viewfilesecuredoc.swisstowerant[.]co
swisstowerant[.]com
forma-viva[.]com
sucdens[.]co
sucdens[.]com
alliadesigns[.]co
alliadesigns[.]com
dispertia[.]co
dispertia[.]com
amplitudecmd[.]co
amplitudecmd[.]com
drstoller[.]co
drstoller[.]com
dayeenterprises[.]co
dezinefusion[.]co
dezinefusion[.]com
itencrypted[.]co
itencrypted[.]com
lcscenter[.]co
koeln-gastro[.]co
koeln-gastro[.]com
her.koeln-gastro[.]com
healthy.koeln-gastro[.]com
oli.koeln-gastro[.]com
papa-jon-pizza.koeln-gastro[.]com
papa-john-pizza.koeln-gastro[.]com
householdwares[.]co
householdwares[.]com
healthy39[.]co
healthy39[.]com
szwhtl[.]com
projectcontrolgroup[.]co
hblnife[.]com
hblnife[.]co
securemailmicrosoftforms.hblnife[.]co
cepoffices[.]com
docusign.cepoffices[.]com
edocusign.cepoffices[.]com
cepoffices[.]co
waitesguide[.]co
iac-ab.waitesguide[.]co
gogreenrei.waitesguide[.]co
sfee.waitesguide[.]co
bktlegal.waitesguide[.]co
patioline.waitesguide[.]co
ifccanada.waitesguide[.]co
leamingtonfoods.waitesguide[.]co
waitesguide[.]com
docusign.waitesguide[.]com
ncclouds[.]co
juicysfamousfairdocument.ncclouds[.]co
rhumbixproposal.ncclouds[.]co
ncclouds[.]com
nationalpaversystem.ncclouds[.]com
lalibation.ncclouds[.]com
bementlaw.ncclouds[.]com
ebertsoft[.]com
antaiyimin[.]com
antaiyimin[.]org
equans.antaiyimin[.]org
czpathos[.]com
czpathos[.]org
sonicweaversinc[.]net
ftwestseattle[.]com
ormic-otp.ftwestseattle[.]com
cgi-ii.ftwestseattle[.]com
zahlung-p.ftwestseattle[.]com
docs-xecure.ftwestseattle[.]com
cgi-amit.ftwestseattle[.]com
cgi-oii.ftwestseattle[.]com
pom-qp.ftwestseattle[.]com
cgi-q.ftwestseattle[.]com
sapir-oi.ftwestseattle[.]com
ox-api.ftwestseattle[.]com
cgi-oi.ftwestseattle[.]com
hotelemilenium[.]com[.]mx
toyotaqueretaro.hotelemilenium[.]com[.]mx
durakdisplay[.]com
liveoakfarmsllc[.]com
liveoakfarmsllc[.]net
cgi-oi.liveoakfarmsllc[.]net
cgi-p3.liveoakfarmsllc[.]net
secure-docs.liveoakfarmsllc[.]net
cgi-secure.liveoakfarmsllc[.]net
oi-ai.liveoakfarmsllc[.]net
avi.liveoakfarmsllc[.]net
otp-oi.liveoakfarmsllc[.]net
cgi-avi.liveoakfarmsllc[.]net
durakdisplay[.]net
neottdesign[.]com
neottdesign[.]net
kecifang[.]com
kecifang[.]net
docusign.kecifang[.]net
netdocusign.kecifang[.]net
docshare.kecifang[.]net
tgfautomotive.kecifang[.]net
travestiilan[.]com
uouso[.]net
icryo.uouso[.]net
uouso[.]com
jobscouthq[.]com
jobscouthq[.]net
kemalradio[.]com
cumminslogistic.kemalradio[.]com
liva-fit[.]com
liva-fit[.]net
enervscler[.]net
enervscler[.]com
usinagesuperieur.enervscler[.]com
cncsinks[.]com
updated-hr-policy.cncsinks[.]com
accounts-bvets-au.cncsinks[.]com
fmfis-sharepoint-fallsmetal.cncsinks[.]com
dealfindrs.cncsinks[.]com
securemailencryptit[.]com
microsoftforms.securemailencryptit[.]com
gardnerimmigrationlaw.securemailencryptit[.]com
acfpdorg.securemailencryptit[.]com
myfavoriteprintercom.securemailencryptit[.]com
goshensorg.securemailencryptit[.]com
adamscountycogov.securemailencryptit[.]com
securemailencryptit[.]net
c0c8e9350576.securemailencryptit[.]net
jijipress.securemailencryptit[.]net
haoekang[.]com
trxid048637.haoekang[.]com
haoekang[.]net
nngresearch[.]com
acmlawoffice.nngresearch[.]com
nngresearch[.]net
docusign.nngresearch[.]net
sharepoint.nngresearch[.]net
docshare.nngresearch[.]net
albairaqllc[.]com
albairaqllc[.]net
nsboards[.]com
nsboards[.]net
zhifabiao[.]com
ametco.zhifabiao[.]com
ametco-acrobat.zhifabiao[.]com
victory-air.zhifabiao[.]com
lvborses[.]com
inpersonevents.lvborses[.]com
lvborses[.]net
cgi-p3.lvborses[.]net
yam-cgi.lvborses[.]net
elad-ox.lvborses[.]net
accounts-cgi.lvborses[.]net
harasin-ox.lvborses[.]net
cgi-oz.lvborses[.]net
khoury-cgi.lvborses[.]net
secure-docs.lvborses[.]net
szfeisi[.]com
ttes.szfeisi[.]com
claremcfaulltc.szfeisi[.]com
uortech.szfeisi[.]com
lamyamerica.szfeisi[.]com
alfdc.szfeisi[.]com
brockdevelopmentcorp.szfeisi[.]com
faxtronics[.]com
opticaberl[.]com
nitroswim.opticaberl[.]com
lalibations.opticaberl[.]com
protechlabcorp.opticaberl[.]com
thebeltonegroup.opticaberl[.]com
borgerproperties.opticaberl[.]com
coserflwang[.]com
cnybrainandspine.coserflwang[.]com
varflex.coserflwang[.]com
aandmgraphics.coserflwang[.]com
advancedbusinessconsulting.coserflwang[.]com
inetcities[.]net
bhchealth.inetcities[.]net
codygroup.inetcities[.]net
tsa.inetcities[.]net
inetcities[.]com
waterlabs.inetcities[.]com
chemexofn.inetcities[.]com
horizondesigns.inetcities[.]com
agsource.inetcities[.]com
criticomms.inetcities[.]com
chemexofni.inetcities[.]com
analytichem.inetcities[.]com
fefc.inetcities[.]com
gcs123.inetcities[.]com
steeredstraight.inetcities[.]com
hck12.inetcities[.]com
radomcorp.inetcities[.]com
azorinc.inetcities[.]com
metalkrafters.inetcities[.]com
git-l.inetcities[.]com
intumedia[.]com
theaxisrpo[.]com
tardgvhse[.]com
tardgvhse[.]net
shivelymotors.tardgvhse[.]net
steelequities.tardgvhse[.]net
nctravelme[.]net
potentialproject.nctravelme[.]net
nxinet[.]com
zbxyom[.]com
ltctechgroup.zbxyom[.]com
suntificconsulting.zbxyom[.]com
newbijouproduction.zbxyom[.]com
camelocthateau.zbxyom[.]com
amadahealth.zbxyom[.]com
nctravelme[.]com
cfhlsmgs[.]com
sheratonelkgrove.cfhlsmgs[.]com
alsum.cfhlsmgs[.]com
litibubayclub.cfhlsmgs[.]com
lightpass.cfhlsmgs[.]com
automotiveinsight.cfhlsmgs[.]com
cwcglobal.cfhlsmgs[.]com
avisford.cfhlsmgs[.]com
irp18.cfhlsmgs[.]com
la-csi.cfhlsmgs[.]com
cfhlsmgs[.]net
innovizeltd[.]com
accesscode.innovizeltd[.]com
microsoftforms-code.innovizeltd[.]com
microsoftforms-access-code.innovizeltd[.]com
securemail-ineda.innovizeltd[.]com
secure-docusign-verification.innovizeltd[.]com
coyne-cundiff-hillemann.innovizeltd[.]com
innovizeltd[.]net
yellowhub.innovizeltd[.]net
ifsafrica.innovizeltd[.]net
protegecasual.innovizeltd[.]net
elec.innovizeltd[.]net
stratforddevelopment.innovizeltd[.]net
aussenwirtschaftsrecht.innovizeltd[.]net
jza.innovizeltd[.]net
ircjunx[.]com
ircjunx[.]net
palwii[.]com
roaworld.palwii[.]com
centralhabitatge[.]com
aya-slmalsons.centralhabitatge[.]com
secure-file.centralhabitatge[.]com
cgi-secure.centralhabitatge[.]com
docs-secure.centralhabitatge[.]com
magna-ss[.]com
docusign.magna-ss[.]com
sucosos[.]com
protectionwire[.]com
woodamanelectricinc.protectionwire[.]com
williamwilsonhomes.protectionwire[.]com
dpriceandassociates.protectionwire[.]com
mindydaniel.protectionwire[.]com
drewlawgroup.protectionwire[.]com
sierraind.protectionwire[.]com
cornerstonelandscapesm.protectionwire[.]com
januarydigital.protectionwire[.]com
pdfxcloud[.]com
victory-air.pdfxcloud[.]com
precisemachine-acrobat.pdfxcloud[.]com
precisemachine-adobeacrobat.pdfxcloud[.]com
anchorinc.pdfxcloud[.]com
schunk-usa[.]com
mahogany-records[.]com
uggsbootsoutletonlines[.]us
patousducourtaou[.]com
unitedkrew[.]com
media2memories[.]com
spindleberryinns[.]co[.]uk
zakosta[.]info
afkarperfumes[.]com
ankportal[.]com
wbconnecticut[.]net
boltonmassachusetts[.]us
secure-file-portal[.]com
c2slogistics[.]online
immersive[.]cfd

File Hashes

Hash Type	Hash	Observed Filename
SHA1	e9621f90091b56c712858a27d3a775cde21c6463	עותק תשלום.pdf
SHA1	f5e9d8ed0a057fbb168bc17ad2ed1faeecae184b	הודעת תשלום.pdf
SHA1	eccbb63a309130bea7caa6a95ec17e5a73ba0bdc	–
SHA1	a1735b2e9eedcb16e73c3e61fbd23ab72615fc72	דוח תשלום.pdf
SHA1	c5f618e32c389016adff85168bb0a1b263e6975d	אישור תשלום.pdf
SHA1	d38597e1d682a2725b9e36a62d8e4a0251011286	–
SHA1	f31a1dcb48467b89da25e8c85baad2a8f5f9aaf3	–
SHA1	8df34b3f32eaa732c1b2a99bf348c4e4a6ff629d	–
SHA1	39d7abdea95ebaee77af715e0fb58a1416bddab3	דו_ח תשלום.pdf
SHA1	099061d5d822c2a3c8a286f8c552460787fa3700	–
SHA1	cb8dfde813ba2345cc8dffa223095d11e2d03381	דו_ח תשלום.pdf
SHA1	802ab4f182973db4727c6906f3bb8ff23eb3fff8	דוח_תשלום.pdf
SHA1	2b9b007b902fab661fbb9a586f071d9194e2fcd7	–
SHA1	fba905bc25a3b130816896f27973913a08e021a7	אישור תשלום1.pdf
SHA1	39bec651adf4a59e60f04c6ab0a9a21c6a120969	–
SHA1	3eeb5a31f648a7fadd4bcc3b7a1959716861425a	–
SHA1	b9be9c836892972af070bf1e4ca815a3781a5eef	דוח תשלום.pdf
SHA1	5339216acb07038a15e4a01418d40e387d47ad37	–
SHA1	0a22851cdb3e6fb209d2c5629490317c6bf4f2b7	עותק תשלום.pdf
SHA1	41bc46eb83b914d74510c1631abad0cae95bfeed	–
SHA1	f0ee455b8e7ea709de27ee4111c145da546ec337	copy invoice.pdf
SHA1	1bc54589a73b759f1f88e17bb06d54249f3dc510	–
SHA1	2da89f591e2bb3679c8a58bc96cf5e7b18af48e7	–
SHA1	d59a78e7b873f562ea9330522d11f2270970c720	–
SHA1	42945ad7f7c0cb9327a890878866e4b877f58399	עותק תשלום.pdf
SHA1	302cead78f476c53b556ccc415f2ee00b5c368aa	הודעת תשלום.pdf
SHA1	f8051481b289b96332c52b61efd160e98f32fb79	דוח תשלום.pdf
SHA1	41930003ad8416d49900e3f313b7e282a892fb16	דוח תשלום.pdf
SHA1	768d6bd60593f95ba9e826655e605276dde50f45	דוחות_תשלום.pdf
SHA1	edc34a9bd77849222254768c8909727d57fc4dc9	אישור תשלום – (sanitized) (1).pdf
SHA1	954fee104a55595224679d6404ede0929f5a4c46	עותק תשלום.pdf
SHA1	c607bf362fe731183d18c0803b7003c22f6d60e6	דוח תשלום.pdf
SHA1	990ca4b3970b0091d4519b2b1693a269f321e957	–
SHA1	16b80c3a0c82c83cf54f33a7b93423343c7b9438	–
SHA1	79b46af742a2f263b76d0fdff59b795b95ba0fbe	Zahlungsbericht.pdf
SHA1	75e009a7199d75d6f80cb81c9e5d8bbc17eda6ed	–
SHA1	e5b0fefbf5d47f4ae667bd7500f079f6de368b82	Zahlungsavis.pdf
SHA1	efe50cd161aaf3f7c9ff7381574032cb97d40e3f	Zahlungsbericht.pdf
SHA1	6a6150817d46a702b807043ba055aef631d309af	Zahlungsbericht.pdf
SHA1	ce2263990900c8998c52d8013fc4f6d70654fb4c	Zahlungsbericht.pdf

Detection and Hunting

The identified infrastructure may change over time. The following YARA rules identify combinations of HTML and JavaScript artifacts associated with the MadApe phishing frontend and its human-verification gate. Apply them to retrieved HTML/JavaScript files or extracted web-response bodies, and validate matches against the surrounding page content.

YARA, MadApe Device Code Phishing Page Detection

rule GIB_MadApe_Phishing_Page
{
    meta:
        author = "Group-IB Threat Intelligence"
        description = "HTML/JavaScript indicators of the MadApe Device Code phishing frontend"
        date = "2026-10-28"
        tlp = "CLEAR"

    strings:
        $api_entered = "/api/code/entered" ascii wide
        $api_status  = "/api/code/status/" ascii wide
        $device      = "microsoft.com/devicelogin" ascii wide nocase
        $clipboard   = "navigator.clipboard.writeText" ascii wide
        $handler     = "function cc()" ascii wide

    condition:
        filesize < 300KB and
        $device and
        $api_entered and
        2 of ($api_status, $clipboard, $handler)
}

YARA, Human-Verification Gate Detection

rule GIB_MadApe_Verification_Gate
{
    meta:
        author = "Group-IB Threat Intelligence"
        description = "Client-side human-verification gate served ahead of the MadApe Device Code phishing page"
        date = "2026-10-28"
        tlp = "CLEAR"

    strings:
        $cookie = "document.cookie='_cv=1;path=/;max-age=300;SameSite=Lax'" ascii wide
        $reload = "setTimeout(()=>window.location.reload(),700)" ascii wide
        $title  = "" ascii wide nocase
        $hold   = "Hold to Verify" ascii wide
        $text   = "Security Verification" ascii wide
        $image  = "Image Verification" ascii wide
        $antidbg = "['I','J','C'].includes(e.key)" ascii wide

    condition:
        filesize < 100KB and $cookie and $reload and ($title or $antidbg) and 1 of ($hold, $text, $image)
}

DISCLAIMER: All technical information, including malware analysis, indicators of compromise and infrastructure details provided in this publication, is shared solely for defensive cybersecurity and research purposes. Group-IB does not endorse or permit any unauthorized or offensive use of the information contained herein. The data and conclusions represent Group-IB’s analytical assessment based on available evidence and are intended to help organizations detect, prevent, and respond to cyber threats.

Group-IB expressly disclaims liability for any misuse of the information provided. Organizations and readers are encouraged to apply this intelligence responsibly and in compliance with all applicable laws and regulations.

This blog may reference legitimate third-party services such as Telegram and others, solely to illustrate cases where threat actors have abused or misused these platforms.

This material is provided for informational purposes, prepared by Group-IB as part of its own analytical investigation, and reflects recently identified threat activity.

All trademarks referenced herein are the property of their respective owners and are used solely for informational purposes, without any implication of affiliation or sponsorship.