A Real Microsoft Sign-in Page Can Still Be Phishing: What MSPs Should Know About MadApe

An employee receives a PDF that appears to be a shared business document. They open it, follow the link, and eventually reach a legitimate Microsoft sign-in page. They enter a code, complete authentication, and expect the document to open.The Microsoft login page is real. The authentication may succeed. The problem is that the employee could be approving an authentication request started by an attacker.That’s the issue behind MadApe, a Microsoft device-code phishing kit documented by Group-IB on October 29, 2026. The research is another reminder that protecting Microsoft 365 accounts involves more than checking whether MFA is enabled.For MSPs managing multiple Microsoft 365 tenants, it also raises a practical question: do we actually know which authentication methods our clients need and which ones their environments currently allow?What Group-IB foundGroup-IB describes a phishing operation that uses business-themed PDF attachments, fake document-sharing pages, and Microsoft…