Loading malware…
SkyW4lker, also known as SkyW4lker x365 Sentinel, is a phishing kit targeting Microsoft 365 accounts through abuse of the OAuth 2.0 device authorization flow. It persuades victims to authorize attacker-initiated device codes on legitimate Microsoft authentication pages, allowing attackers to obtain application access tokens and access resources available to the compromised identity. The core attack does not require password theft or a technical bypass of multifactor authentication; victims complete the legitimate authorization process on the attacker's behalf.
Campaigns use business-themed phishing emails containing password-protected document attachments, often presented as contracts, invoices, or service proposals. Embedded links lead through intermediary pages hosted on legitimate services, including Google Sites, before reaching the authorization workflow. CAPTCHA gates, decoy pages, and obfuscated JavaScript hinder automated analysis. A PHP backend registers visitor sessions, while client-side code repeatedly polls for authentication completion. The infrastructure also collects visitor IP addresses, geolocation, ISP, and organization information.
SkyW4lker targets enterprise users, including organizations in manufacturing, technology, and healthcare. Its use of legitimate authentication infrastructure can make malicious authorization difficult to distinguish from routine activity without correlating phishing delivery, browser behavior, and identity events. SkyW4lker shares JavaScript modules, CAPTCHA components, and infrastructure patterns with the Gabagool credential-phishing kit.
13 distinct techniques documented for this family, organized by ATT&CK tactic.
The SkyW4lker operator collected recipient e-mail addresses to personalise phishing links using the landing-URL suffix ? or ?? after /it[A-Za-z0-9]{32}us.
The SkyW4lker phishing kit recorded the visitor's IP address, ISP, organisation and location to profile victims using client_geo.js.
The SkyW4lker operator registered look-alike domains of real companies to host phishing pages using typo-squatted names under Microsoft-themed subdomain chains.
The SkyW4lker operator rented virtual private servers to run the PHP backend using DigitalOcean hosting (50 of 92 backend IP addresses).
The SkyW4lker operator staged intermediate pages to forward victims to the kit using public cloud buckets and site builders.
The attacker sends the victim a phishing email with a password-protected attachment.
The SkyW4lker operator sent links hosted on legitimate services to pass e-mail reputation checks using Google Sites, Axure Cloud and Smartsheet pages and the maps.google[.]ie/url?q= redirect.
The SkyW4lker phishing kit relied on the victim opening the landing link to start a phishing session.
The SkyW4lker phishing kit obfuscated its JavaScript to hinder analysis using obfuscator.io-style code (520 of 618 analyses carry the obfuscated-js tag).
The SkyW4lker phishing kit placed a CAPTCHA in front of the phishing page to hide it from automated scanners.
The SkyW4lker operator imitated routine business correspondence to make the lures credible using subjects such as New Submission From, Approved Statement and Fedwire Funds Service Processed.
endpoint.js ... logs the e-mail address, password, browser, MFA status, country and other auxiliary fields used during authentication and sends them to the PHP backend at php/endpoints/accounts.php.
The SkyW4lker phishing kit abused the Microsoft OAuth 2.0 device-code flow to obtain the victim's access tokens.
The SkyW4lker phishing kit placed a CAPTCHA in front of the phishing page to hide it from automated scanners.
endpoint.js ... logs the e-mail address, password, browser, MFA status, country and other auxiliary fields used during authentication and sends them to the PHP backend at php/endpoints/accounts.php.
164 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.