MadApe: The Code That Opens the Door
- Published by
- Group-IB
- Published
- 29 Oct 2026
- Indicators
- 1 verified
The report
Group-IB uncovers MadApe, a previously undocumented Microsoft Device Code phishing kit that uses business-themed PDF lures, configurable redirects and fake document-sharing pages to trick victims into completing Microsoft Device Code authentication across a broad infrastructure cluster.
Read the full analysis: MadApe: The Code That Opens the Door (Group-IB).
Indicators
Phishing
- itencrypted[.]co
Defanged so they cannot be clicked by mistake: replace [.] with a dot. Shared hosting and CDN addresses named in the report are left out on purpose, so blocking these does not break legitimate sites.
How this is tracked
EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#30). This page is generated from that record and the report’s own title and summary; nothing is rewritten.