SkyW4lker Phishing Kit Abuses Microsoft Device Codes to Access Microsoft 365 Accounts

The SkyW4lker phishing campaign, also branded SkyW4lker x365 Sentinel, abuses Microsoft's OAuth device-code authentication flow to gain access to Microsoft 365 accounts without stealing passwords. Primarily targeting U.S. organizations in manufacturing, technology, and healthcare, the campaign uses password-protected email attachments, fake business documents, Google-hosted pages, and CAPTCHA gates to steer victims toward legitimate Microsoft authentication pages. Victims complete attacker-initiated authorization flows, enabling attackers to obtain authentication tokens even for MFA-protected accounts; the technique exploits user authorization rather than technically bypassing MFA. ANY.RUN identified 618 associated sandbox analyses between June and October 21, 2026, with 46% originating from the United States—a measure of analysis submissions, not confirmed compromises. Targeting was also observed in India, Canada, and the United Kingdom.

Researchers identified obfuscated JavaScript and a PHP backend that manage victim sessions, collect IP addresses and geolocation, and poll for authentication completion. Shared JavaScript modules, URL structures, CAPTCHA components, and infrastructure led ANY.RUN to assess with high confidence that SkyW4lker and the Gabagool credential-phishing kit share a developer, although common operation remains unconfirmed. Defenders should restrict unnecessary device-code authentication, correlate suspicious documents and browser activity with Microsoft Entra ID authentication events, and investigate subsequent Microsoft 365 activity when compromise is suspected. Because authentication occurs through legitimate Microsoft pages, investigators need the surrounding email, browsing, and infrastructure evidence to distinguish malicious authorization from normal sign-ins.