BlackApex

BlackApex is a Microsoft 365 device-code phishing kit belonging to a shared family deployed across more than 70 instances. Related deployments use administrative-panel names including DarkApex, SPY, and XXX101-TOKEN and share backend behavior, administrative interfaces, and lure implementations. These names have not been conclusively linked to distinct operators or established threat groups.

The kit uses business-themed spearphishing emails, embedded links, and PDF attachments to direct victims through legitimate cloud services to branded phishing pages. Observed lures impersonate SharePoint, Zoom, Adobe Acrobat Sign, Microsoft Excel, and OneDrive. Rather than collecting passwords through a counterfeit authentication form, the kit persuades victims to enter an attacker-requested device code on Microsoft's genuine authentication page. Victims complete authentication, including MFA, thereby authorizing the attacker-initiated session. The attacker's backend polls for completion and obtains access and refresh tokens that enable unauthorized access to Microsoft 365 resources.

BlackApex incorporates multistage redirects, Cloudflare Turnstile checks, and configurable landing-page routing to impede automated inspection and URL-based blocking. Its lures support organization-specific branding, authentication-status polling, device-code renewal, and redirection to legitimate Microsoft pages after successful authorization. Administrative functionality includes campaign configuration, template and domain management, anti-bot controls, access logs, and session management.