BlackApex and SPY Phishing Kits Abuse Microsoft Device Codes to Steal Access Tokens

LevelBlue SpiderLabs researchers identified a previously undocumented family of Microsoft 365 device-code phishing kits deployed across more than 70 instances under names including BlackApex, DarkApex, SPY, and XXX101-TOKEN. The campaigns combine business-themed spearphishing, trusted cloud services, and branded lures to persuade victims to authorize attacker-initiated sign-ins on genuine Microsoft authentication pages. Victims complete MFA themselves, enabling attackers to obtain access and refresh tokens without capturing passwords. The report also claims that administrative panels display captured Primary Refresh Tokens, although that capability is not independently established in the supplied reporting.

Researchers assess with high confidence that the shared codebase was largely developed with AI assistance, citing consistent implementations across five lure types, extensive comments, and polished error handling. Exposed robots.txt files and reportedly unauthenticated administrative APIs helped researchers discover infrastructure and correlate campaign-management interfaces. The findings highlight how phishing-as-a-service offerings are lowering barriers to device-code abuse. Organizations should restrict or block device-code authentication through Microsoft Entra Conditional Access where unnecessary, monitor device-code sign-in activity, and train users to reject unexpected authorization requests even when they appear on legitimate Microsoft pages.