Skip to content
Scammers.com

Search results

Screenshot of a SharePoint-themed phishing lure page showing a verification code and a "Continue to SharePoint" button
PhishingReviewed

LevelBlue: 'BlackApex' device-code phishing kits steal Microsoft 365 tokens via fake SharePoint and Zoom lures

LevelBlue SpiderLabs described on 30 October 2026 “BlackApex”-family phishing kits that use fake SharePoint and Zoom pages to get victims to approve a Microsoft device code and give attackers Microsoft 365 tokens. Microsoft and Zoom are not involved.

  • miscrosoftonlinesecuredemandocument.com
  • Also securemsexcel.online, 1mdrvpdf-rfqonlineinvite.com; kit panels BlackApex, DarkApex, SPY, XXX101
Reported Oct 30, 20261 report

Results reflect reports submitted to Scammers.com. Entries marked “Unverified” have not yet been reviewed. A listing is not a finding that any person or business committed fraud.