Skyw4lker device code phishing kit takes over Microsoft 365 accounts without stealing passwords

What happened

ANY.RUN published analysis of Skyw4lker, a device code phishing campaign that primarily targets U.S. organizations. The Hacker News carried the first report on Oct 28, 2026, as a contributed partner piece. Cyber Security News followed on November 4, 2026 with more detail. Neither source is an official CERT, vendor or CVE record, and both draw on ANY.RUN’s own data.

How the attack works. Instead of stealing a password on a fake login page, the attacker starts a legitimate Microsoft device authorization flow and persuades the victim to complete it. The attacker then receives the resulting Microsoft 365 tokens (The Hacker News). Cyber Security News describes it as abuse of the OAuth 2.0 device code flow. The victim enters a code on a real Microsoft page, completes MFA if prompted, and the attacker’s backend gets an OAuth access token. The sign-in appears in Entra ID as a legitimate device code authentication (Cyber Security News).

Delivery and lure chain.

• The lure is a password-protected PDF, DOCX or XLSX presented as a contract, invoice, statement or service proposal. The password is in the email body. Cyber Security News’s table also lists EML attachments and Fedwire payment notice themes.
• The document links to a page, often a CAPTCHA page, hosted on sites[.]google[.]com (The Hacker News). Cyber Security News also lists Google Maps, Miro, Zoom, Smartsheet, Axure Cloud, Cloudflare R2 and Linode object storage as hosts for lure or redirect pages.
• The CAPTCHA, either Cloudflare Turnstile or the kit’s own widget, keeps automated scanners from reaching the payload page.

Kit internals (Cyber Security News):

• The kit is also branded SkyW4lker x365 Sentinel and has a PHP backend with obfuscator.io-style JavaScript.
• The page talks to /session_public.php. action=start sends the victim’s IP, ISP, organization and geolocation and returns a session ID. action=poll runs every few seconds until authentication completes.
• Helper modules are /js/client_geo.js, /js/url_helper.js and /js/endpoint.js. The last logs email, password, browser, MFA status and country to php/endpoints/accounts.php.
• An admin panel at /admin/index.php offers Telegram-delivered MFA for operators, a victim dashboard, phishing link generation and real-time notifications when a target opens a link.
• The kit first appeared on June 23, 2026. ANY.RUN tracked 618 sandbox analyses through October 21, 2026, with monthly submissions rising from 20 in June to 200 in September.
• Of the 92 backend IPs, 50 were on DigitalOcean. The article also mentions look-alike domains and free dynamic DNS hosts, and refers to 170-plus domains.
• ANY.RUN assesses with high confidence that one developer built both Skyw4lker and the Gabagool credential-phishing kit, which has been active since April 2026.

Targeting. About 46 to 47 percent of sandbox submissions came from the United States, followed by India, Canada and the UK. The sector focus differs by source. The Hacker News says manufacturing, technology and healthcare. Cyber Security News says technology, manufacturing and government. These figures reflect sandbox submissions, not confirmed victim counts. The number of compromised accounts is not confirmed.

Am I affected?

You are potentially exposed if:

• Your organization uses Microsoft 365 and Entra ID and allows device code authentication broadly. Cyber Security News notes that in that case MFA alone will not stop this attack, because the user genuinely completes an MFA-protected sign-in.
• Employees receive vendor, contract or invoice documents as password-protected attachments with the password in the email body.
• You are in a sector named in the reporting (technology, manufacturing, healthcare, government) or based in the US. Other regions also appear in the submissions.

A compromised token can expose Outlook, OneDrive, SharePoint, Teams and apps federated through Entra ID. It can also be used to phish customers and partners from a trusted address (Cyber Security News).

No CVE, patch or fixed version applies. This is an abuse of legitimate authentication behavior, and the sources give no vendor fix.

What to do now

1. Find out whether device code authentication is needed in your tenant, and restrict it where it is not. The sources identify broad permission as the policy gap but do not give specific settings, so those are not confirmed.
2. Hunt Entra ID sign-in logs since June 2026 for device code authentications that users cannot account for. The sources note these look legitimate, so correlate them with the phishing email, the document and the web activity (The Hacker News).
3. Search web proxy and email telemetry for password-protected PDF, DOCX or XLSX attachments with the password in the body, followed by visits to Google Sites or similar hosted pages and CAPTCHA gates.
4. Search for the URL pattern /session_public.php (including action=start and action=poll), and for the module paths /js/client_geo.js, /js/url_helper.js and /js/endpoint.js. Pull current IOCs from ANY.RUN’s sandbox analysis, since the articles do not list a full indicator set.
5. If a user completed a suspicious device code prompt, treat the account as compromised. Session and token revocation steps are not detailed in the sources, so follow your own identity incident procedure and scope what the account accessed.
6. Warn staff that entering a code on a real Microsoft page can still hand an attacker access, and that a password-protected contract with a code prompt is a red flag.
7. Expect infrastructure to change. Cyber Security News reports the kit has been continuously updated with new endpoints and changing URL tokens, so do not rely on static indicators alone.

Sources

• The Hacker News: American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed (contributed ANY.RUN piece, Oct 28, 2026)
• Cyber Security News: SkyW4lker Phishing Campaign Expands, Threatening US Enterprises with Microsoft 365 Account Takeovers (November 4, 2026)