Security researchers described a new phishing kit called MadApe that targets Microsoft 365 accounts using a method called device code phishing. According to The Hacker News, the kit was first observed by Group-IB and uses business-themed PDF lures and fake document-sharing pages.
How it works
Microsoft lets you sign in from devices without a convenient keyboard, such as a TV, using a short code typed on an official Microsoft site. The attackers exploit this: they send the victim a code and ask them to enter it on Microsoft's real site "to view a document". Once the victim enters the code and signs in, they are actually granting the attacker access to their account.
Why it is especially dangerous
Because the victim doesn't type a password on a fake site, but signs in on Microsoft's real site and approves the two-factor check themselves. So the usual defenses don't help. According to reports, another campaign of this type, Skyw4lker, mainly targets US organizations.
How to defend
A simple rule: if someone sends you a code and asks you to enter it on Microsoft's site, don't, unless you yourself are connecting a device at that moment. Administrators can block the device code flow in their organization, if it isn't needed, through Microsoft's conditional access policies.
