LevelBlue: 'BlackApex' device-code phishing kits steal Microsoft 365 tokens via fake SharePoint and Zoom lures
LevelBlue SpiderLabs described on 30 October 2026 “BlackApex”-family phishing kits that use fake SharePoint and Zoom pages to get victims to approve a Microsoft device code and give attackers Microsoft 365 tokens. Microsoft and Zoom are not involved.
- First reported
- Reports
- 1
Source: levelblue.com · published
What happened
On 30 October 2026 researchers at LevelBlue SpiderLabs described a family of phishing kits that abuse Microsoft's device-code sign-in flow. The kits operate under panel names including BlackApex, DarkApex, SPY and XXX101, and the researchers found more than 70 instances sharing one backend. The landing pages use lures dressed as SharePoint, Zoom, Adobe Acrobat Sign, Excel and OneDrive. Microsoft, Zoom and the other brands are impersonated by the pages and are not involved. Landing-page domains in LevelBlue's indicators include miscrosoftonlinesecuredemandocument.com, securemsexcel.online and 1mdrvpdf-rfqonlineinvite.com.
How the scam works
LevelBlue explains that the lure page asks its backend for a Microsoft device code and shows it to the victim, with a button that copies the code and opens Microsoft's real microsoft.com/devicelogin page in a popup. Everything on that Microsoft page is genuine. The attacker's server polls every five seconds and, once the victim has signed in and completed multi-factor authentication, redeems the code and holds access and refresh tokens for the victim's Microsoft 365 account. The victim is then sent to a real Microsoft page so the session looks normal. In effect, the MFA that should stop an attacker is satisfied by the victim. The researchers also report that the kit can capture a Primary Refresh Token used to reach a mailbox.
The emails reach victims through trusted services, including a Google share link and a Microsoft Forms page that links on to the lure, which helps them past reputation filters. LevelBlue assesses with high confidence that the code was largely written with AI assistance. For defenders it recommends reviewing Entra ID sign-in logs for unusual device-code events and using Conditional Access to block device-code authentication where it is not needed. For users, the key advice is to treat any unexpected request to enter a device or access code as suspicious, even on a genuine Microsoft sign-in page. LevelBlue notes that infrastructure ownership and domain resolution may change over time.
Source
LevelBlue SpiderLabs, research blog on AI-assisted device-code phishing kits (BlackApex), 30 October 2026.
Red flags
- An email with a link through a Google share link or a Microsoft Forms page that leads to a “verification code” page.
- A page styled as SharePoint, Zoom, Adobe Acrobat Sign, Excel or OneDrive that gives you a code to paste into a Microsoft sign-in.
- A Microsoft page that says you are signing in to “Microsoft Authentication Broker” on another device.
- Look-alike domains such as miscrosoftonlinesecuredemandocument.com or securemsexcel.online.
- A request to enter an access or device code you did not start yourself.
If you were targeted
- 1Do not enter a device or access code at microsoft.com/devicelogin that a page or email gave you unless you started the sign-in.
- 2If you did, report it to your IT team or Microsoft 365 admin straight away so tokens can be revoked and sessions reset.
- 3Administrators should review Entra ID sign-in logs for unusual deviceCodeFlow events.
- 4Where possible, use Conditional Access to block device-code authentication or limit it to approved devices and groups.
- 5Report suspicious shared-document emails rather than opening them.