
PhishingReviewed
LevelBlue: 'BlackApex' device-code phishing kits steal Microsoft 365 tokens via fake SharePoint and Zoom lures
LevelBlue SpiderLabs described on 30 October 2026 “BlackApex”-family phishing kits that use fake SharePoint and Zoom pages to get victims to approve a Microsoft device code and give attackers Microsoft 365 tokens. Microsoft and Zoom are not involved.
- miscrosoftonlinesecuredemandocument.com
- Also securemsexcel.online, 1mdrvpdf-rfqonlineinvite.com; kit panels BlackApex, DarkApex, SPY, XXX101
Reported Oct 30, 20261 report