BlackApex, SPY, and Counting: The Emerging Wave of Vibe-Coded Phishing Kits

Date: 11/02/2026

Severity: High

Summary

Researchers identified BlackApex, DarkApex, SPY, and XXX101, a family of AI-assisted, vibe-coded Phishing-as-a-Service (PhaaS) kits with more than 70 observed instances targeting Microsoft 365 accounts. The kits abuse OAuth device-code phishing through spoofed SharePoint, Zoom, OneDrive, and other business-themed lures, tricking victims into completing legitimate Microsoft authentication and MFA to facilitate access-token, refresh-token, and Primary Refresh Token (PRT) theft. The operation uses spearphishing, CAPTCHA checks, multi-stage redirects, and randomized landing URLs, while exposed administrative portals reveal infrastructure and operational weaknesses. The research highlights the growing use of AI-assisted phishing development, MFA bypass, and cloud identity compromise.

Indicators of Compromise (IOC) List

Domains/URLs

1mdrvpdf-rfqonlineinvite.com

aaqkadnmmwuxntg2l.apiaccoumtsvcdocushare.icu

acuvuemoist.my

arcomplianceservices.cfd

aviationcustom.top

bloob-seattacfiile.info

clouddecktech.online

company-technicalrfqbooking.com

consultantpafc.top

debittordis.top

dglsolutions.co

docspecssharedfilcbcdfc0e.top

dokermainkel.info

dvernoy-gigant.com

dwwcuivvbvhofficial.icu

enduretech.sbs

file-shared.top

freshfarmfindsltd.info

funitubes.com

gatheringsw.iotal-makngrovesmakiliyuhc.icu

glabowlconstruction.work

glouiside.pro

growthingjustreiupi.info

harveyblindsdocxdrop.com

homecraftygen.icu

hsuonoormidimostrareguillarianmelengueleandoinfundieseis.fit

jeoandmass.com

jeoangteam.com

kolbhc.sbs

listingonreferral.com

microservices1.online

miscrosoftonlinesecuredemandocument.com

nricrostryfi.my

ogin.murfin-drilling.com

opttomie.com

ostiumbombicisappartamentocravatta.fit

pacificag0365.org

pattwhitney.com

playersjjets.com

reakonfilesharing.com

rockleghindustries.com

rvmlaws.com

scheduleprice.com

securedocumentaccess.info

securemsexcel.online

selecteventsgroup.com

shabenconstructions.com

shared-b0fjhewe365filow.online

sharedhomedrlvepdfdocx.homes

shubysf.live

southvvesternpts.online

tenderdocuments.sbs

uixoxzxmisu.icu

undoc.sbs

vendorposter.com

viaquestincs.com

waessote.com

waystaffing.sbs

westernhud.com

wrcribbs.com

IP Address

104.194.155.42

104.223.79.210

107.172.90.191

140.150.232.52

144.172.106.171

144.172.98.174

146.19.49.245

146.190.66.199

149.28.221.141

159.65.76.137

167.88.172.122

168.222.97.14

172.86.113.213

172.86.125.91

172.86.91.180

178.83.121.58

185.246.131.15

185.56.45.250

192.166.82.111

199.192.20.72

199.192.20.82

201.79.49.120

216.126.225.45

217.217.97.183

37.10.71.120

37.10.71.147

38.146.28.138

40.160.141.14

40.160.143.25

45.13.238.147

45.59.126.32

45.61.134.94

45.61.148.52

45.61.157.154

45.61.170.139

45.61.178.231

45.61.183.132

45.61.183.137

45.88.91.34

47.236.86.160

47.237.131.61

5.181.156.166

5.83.138.204

64.224.17.244

64.224.17.40

64.44.157.97

67.205.158.128

74.0.32.5

85.120.216.225

87.251.79.252

91.235.234.221

92.118.235.83

94.103.188.232

95.133.228.139

95.133.228.162

95.133.228.241

95.133.228.253

95.133.229.220

95.133.229.247

95.133.230.128

95.133.230.141

95.133.230.85

95.133.231.108

95.133.231.24

95.133.231.26

95.133.231.90

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Detection Query 1 :

domainname like "glouiside.pro" or url like "glouiside.pro" or siteurl like "glouiside.pro" or domainname like "undoc.sbs" or url like "undoc.sbs" or siteurl like "undoc.sbs" or domainname like "dokermainkel.info" or url like "dokermainkel.info" or siteurl like "dokermainkel.info" or domainname like "dwwcuivvbvhofficial.icu" or url like "dwwcuivvbvhofficial.icu" or siteurl like "dwwcuivvbvhofficial.icu" or domainname like "glabowlconstruction.work" or url like "glabowlconstruction.work" or siteurl like "glabowlconstruction.work" or domainname like "aviationcustom.top" or url like "aviationcustom.top" or siteurl like "aviationcustom.top" or domainname like "clouddecktech.online" or url like "clouddecktech.online" or siteurl like "clouddecktech.online" or domainname like "growthingjustreiupi.info" or url like "growthingjustreiupi.info" or siteurl like "growthingjustreiupi.info" or domainname like "login.enchantingreality.com" or url like "login.enchantingreality.com" or siteurl like "login.enchantingreality.com" or domainname like "ostiumbombicisappartamentocravatta.fit" or url like "ostiumbombicisappartamentocravatta.fit" or siteurl like "ostiumbombicisappartamentocravatta.fit" or domainname like "pacificag0365.org" or url like "pacificag0365.org" or siteurl like "pacificag0365.org" or domainname like "shubysf.live" or url like "shubysf.live" or siteurl like "shubysf.live" or domainname like "scheduleprice.com" or url like "scheduleprice.com" or siteurl like "scheduleprice.com" or domainname like "debittordis.top" or url like "debittordis.top" or siteurl like "debittordis.top" or domainname like "playersjjets.com" or url like "playersjjets.com" or siteurl like "playersjjets.com" or domainname like "tenderdocuments.sbs" or url like "tenderdocuments.sbs" or siteurl like "tenderdocuments.sbs" or domainname like "uixoxzxmisu.icu" or url like "uixoxzxmisu.icu" or siteurl like "uixoxzxmisu.icu" or domainname like "1mdrvpdf-rfqonlineinvite.com" or url like "1mdrvpdf-rfqonlineinvite.com" or siteurl like "1mdrvpdf-rfqonlineinvite.com" or domainname like "wrcribbs.com" or url like "wrcribbs.com" or siteurl like "wrcribbs.com" or domainname like "rockleghindustries.com" or url like "rockleghindustries.com" or siteurl like "rockleghindustries.com" or domainname like "securemsexcel.online" or url like "securemsexcel.online" or siteurl like "securemsexcel.online" or domainname like "rvmlaws.com" or url like "rvmlaws.com" or siteurl like "rvmlaws.com" or domainname like "microservices1.online" or url like "microservices1.online" or siteurl like "microservices1.online" or domainname like "opttomie.com" or url like "opttomie.com" or siteurl like "opttomie.com" or domainname like "sharedhomedrlvepdfdocx.homes" or url like "sharedhomedrlvepdfdocx.homes" or siteurl like "sharedhomedrlvepdfdocx.homes" or domainname like "login.jyctruckings.com" or url like "login.jyctruckings.com" or siteurl like "login.jyctruckings.com" or domainname like "docspecssharedfilcbcdfc0e.top" or url like "docspecssharedfilcbcdfc0e.top" or siteurl like "docspecssharedfilcbcdfc0e.top" or domainname like "pattwhitney.com" or url like "pattwhitney.com" or siteurl like "pattwhitney.com" or domainname like "shared-b0fjhewe365filow.online" or url like "shared-b0fjhewe365filow.online" or siteurl like "shared-b0fjhewe365filow.online" or domainname like "jeoangteam.com" or url like "jeoangteam.com" or siteurl like "jeoangteam.com" or domainname like "listingonreferral.com" or url like "listingonreferral.com" or siteurl like "listingonreferral.com" or domainname like "hsuonoormidimostrareguillarianmelengueleandoinfundieseis.fit" or url like "hsuonoormidimostrareguillarianmelengueleandoinfundieseis.fit" or siteurl like "hsuonoormidimostrareguillarianmelengueleandoinfundieseis.fit" or domainname like "westernhud.com" or url like "westernhud.com" or siteurl like "westernhud.com" or domainname like "company-technicalrfqbooking.com" or url like "company-technicalrfqbooking.com" or siteurl like "company-technicalrfqbooking.com" or domainname like "login.mantanolo.online" or url like "login.mantanolo.online" or siteurl like "login.mantanolo.online" or domainname like "login.championconstractors.com" or url like "login.championconstractors.com" or siteurl like "login.championconstractors.com" or domainname like "southvvesternpts.online" or url like "southvvesternpts.online" or siteurl like "southvvesternpts.online" or domainname like "freshfarmfindsltd.info" or url like "freshfarmfindsltd.info" or siteurl like "freshfarmfindsltd.info" or domainname like "arcomplianceservices.cfd" or url like "arcomplianceservices.cfd" or siteurl like "arcomplianceservices.cfd" or domainname like "login.energiapd.online" or url like "login.energiapd.online" or siteurl like "login.energiapd.online" or domainname like "reakonfilesharing.com" or url like "reakonfilesharing.com" or siteurl like "reakonfilesharing.com" or domainname like "selecteventsgroup.com" or url like "selecteventsgroup.com" or siteurl like "selecteventsgroup.com" or domainname like "jeoandmass.com" or url like "jeoandmass.com" or siteurl like "jeoandmass.com" or domainname like "nricrostryfi.my" or url like "nricrostryfi.my" or siteurl like "nricrostryfi.my" or domainname like "vendorposter.com" or url like "vendorposter.com" or siteurl like "vendorposter.com" or domainname like "consultantpafc.top" or url like "consultantpafc.top" or siteurl like "consultantpafc.top" or domainname like "funitubes.com" or url like "funitubes.com" or siteurl like "funitubes.com" or domainname like "securedocumentaccess.info" or url like "securedocumentaccess.info" or siteurl like "securedocumentaccess.info" or domainname like "file-shared.top" or url like "file-shared.top" or siteurl like "file-shared.top" or domainname like "bloob-seattacfiile.info" or url like "bloob-seattacfiile.info" or siteurl like "bloob-seattacfiile.info" or domainname like "gatheringsw.iotal-makngrovesmakiliyuhc.icu" or url like "gatheringsw.iotal-makngrovesmakiliyuhc.icu" or siteurl like "gatheringsw.iotal-makngrovesmakiliyuhc.icu" or domainname like "waessote.com" or url like "waessote.com" or siteurl like "waessote.com" or domainname like "aaqkadnmmwuxntg2l.apiaccoumtsvcdocushare.icu" or url like "aaqkadnmmwuxntg2l.apiaccoumtsvcdocushare.icu" or siteurl like "aaqkadnmmwuxntg2l.apiaccoumtsvcdocushare.icu" or domainname like "dglsolutions.co" or url like "dglsolutions.co" or siteurl like "dglsolutions.co" or domainname like "homecraftygen.icu" or url like "homecraftygen.icu" or siteurl like "homecraftygen.icu" or domainname like "kolbhc.sbs" or url like "kolbhc.sbs" or siteurl like "kolbhc.sbs" or domainname like "shabenconstructions.com" or url like "shabenconstructions.com" or siteurl like "shabenconstructions.com" or domainname like "harveyblindsdocxdrop.com" or url like "harveyblindsdocxdrop.com" or siteurl like "harveyblindsdocxdrop.com" or domainname like "viaquestincs.com" or url like "viaquestincs.com" or siteurl like "viaquestincs.com" or domainname like "waystaffing.sbs" or url like "waystaffing.sbs" or siteurl like "waystaffing.sbs" or domainname like "ogin.murfin-drilling.com" or url like "ogin.murfin-drilling.com" or siteurl like "ogin.murfin-drilling.com" or domainname like "login.murfin-drilling.com" or url like "login.murfin-drilling.com" or siteurl like "login.murfin-drilling.com" or domainname like "enduretech.sbs" or url like "enduretech.sbs" or siteurl like "enduretech.sbs" or domainname like "miscrosoftonlinesecuredemandocument.com" or url like "miscrosoftonlinesecuredemandocument.com" or siteurl like "miscrosoftonlinesecuredemandocument.com" or domainname like "acuvuemoist.my" or url like "acuvuemoist.my" or siteurl like "acuvuemoist.my" or domainname like "dvernoy-gigant.com" or url like "dvernoy-gigant.com" or siteurl like "dvernoy-gigant.com" or domainname like "login.video-call.cfd" or url like "login.video-call.cfd" or siteurl like "login.video-call.cfd"

Detection Query 2 :

dstipaddress IN ("64.224.17.40","45.61.170.139","64.44.157.97","95.133.228.139","87.251.79.252","45.61.183.132","144.172.106.171","149.28.221.141","185.246.131.15","45.59.126.32","199.192.20.72","45.61.157.154","95.133.229.220","95.133.228.241","146.19.49.245","172.86.113.213","192.166.82.111","45.88.91.34","5.181.156.166","64.224.17.244","172.86.125.91","85.120.216.225","95.133.230.128","92.118.235.83","67.205.158.128","185.56.45.250","40.160.143.25","104.194.155.42","45.61.178.231","168.222.97.14","167.88.172.122","144.172.98.174","217.217.97.183","37.10.71.120","37.10.71.147","172.86.91.180","45.61.183.137","104.223.79.210","95.133.230.141","95.133.231.24","47.236.86.160","95.133.231.108","95.133.231.26","146.190.66.199","45.61.134.94","45.61.148.52","47.237.131.61","74.0.32.5","95.133.228.253","95.133.230.85","95.133.231.90","5.83.138.204","94.103.188.232","178.83.121.58","91.235.234.221","40.160.141.14","95.133.229.247","199.192.20.82","38.146.28.138","140.150.232.52","107.172.90.191","216.126.225.45","45.13.238.147","95.133.228.162","159.65.76.137","201.79.49.120") or srcipaddress IN ("64.224.17.40","45.61.170.139","64.44.157.97","95.133.228.139","87.251.79.252","45.61.183.132","144.172.106.171","149.28.221.141","185.246.131.15","45.59.126.32","199.192.20.72","45.61.157.154","95.133.229.220","95.133.228.241","146.19.49.245","172.86.113.213","192.166.82.111","45.88.91.34","5.181.156.166","64.224.17.244","172.86.125.91","85.120.216.225","95.133.230.128","92.118.235.83","67.205.158.128","185.56.45.250","40.160.143.25","104.194.155.42","45.61.178.231","168.222.97.14","167.88.172.122","144.172.98.174","217.217.97.183","37.10.71.120","37.10.71.147","172.86.91.180","45.61.183.137","104.223.79.210","95.133.230.141","95.133.231.24","47.236.86.160","95.133.231.108","95.133.231.26","146.190.66.199","45.61.134.94","45.61.148.52","47.237.131.61","74.0.32.5","95.133.228.253","95.133.230.85","95.133.231.90","5.83.138.204","94.103.188.232","178.83.121.58","91.235.234.221","40.160.141.14","95.133.229.247","199.192.20.82","38.146.28.138","140.150.232.52","107.172.90.191","216.126.225.45","45.13.238.147","95.133.228.162","159.65.76.137","201.79.49.120")

Reference:
Emerging AI-Assisted Phishing Threats

BlackApex, SPY, and Counting: The Emerging Wave of Vibe-Coded Phishing Kits

Summary

Indicators of Compromise (IOC) List

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Tags

Comments

BlackApex, SPY, and Counting: The Emerging Wave of Vibe-Coded Phishing Kits

Summary

Indicators of Compromise (IOC) List

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Tags

Share This

Comments