How do I check whether I am affected by CMP-202610-skyw4lker-device-code-phishing-kit-takes-over-microsoft-365-?

- In Entra ID sign-in logs, look for sign-ins with authentication protocol 'deviceCode' that users did not expect, especially soon after they opened an emailed document. - In proxy or DNS logs, look for URLs with /session_public.php?action=start or action=poll, /assets/php/endpoints/confirm_visit.php, /js/client_geo.js, /js/url_helper.js, /js/endpoint.js, /assets/private_captcha/public/widget.js?v=4, or /admin/index.php on the same host. - Look for landing tokens matching zt[A-Za-z0-9]{32}op or it[A-Za-z0-9]{32}us. - Check for these hosts: 5200m[.]com/kvme2/, torvion[.]life/ofulium/, ghethim[.]com/hyllen/, goldcreekconcrete[.]com, goldcreekconcrete[.]org, priorispace[.]biz, and IP 172.86.85[.]51. - Look for emails with password-protected attachments where the password is in the message body.

Live › campaign › CMP-202610-skyw4lker-device-code-phishing-kit-takes-over-microsoft-365-

Go to dashboard

high⚡ Early warning · no CVE yetSkyW4lkerSkyW4lker x365 SentinelExploited in the wildVendor

SkyW4lker device-code phishing kit takes over Microsoft 365 accounts without stealing passwords, mainly at US companies

Q: What is the fix for CMP-202610-skyw4lker-device-code-phishing-kit-takes-over-microsoft-365-?

- Use an Entra ID Conditional Access authentication-flows policy to block the device code flow for all users, except named accounts that need it (for example meeting-room devices). - If you find a suspicious device-code sign-in, revoke that user's sessions and refresh tokens, review their mailbox rules and OAuth app consents, and look at what was accessed. - Warn staff that a document or web page asking them to type a code at microsoft.com/devicelogin is phishing. - Block the listed domains and IP at the mail gateway and proxy.

SkyW4lker (also SkyW4lker x365 Sentinel) is an active phishing kit. Victims get an email with a password-protected PDF, DOCX or XLSX attachment, and the password is in the email body. The lures are contracts, invoices and service proposals. The document links to a CAPTCHA page, sometimes by way of a lure on Google Sites, Miro or Zoom. The final page asks the victim to enter a device code on Microsoft's real login page. That gives the attacker tokens for the Microsoft 365 account. No password is stolen, and MFA does not stop it. ANY.RUN (2026-10-27) counted 618 sandbox analyses from 2026-06-23 to 2026-10-21, rising from 20 a month in June to 200 in September. About 46% came from the US, then India, Canada and the UK. Targets are mainly technology, manufacturing, government and healthcare. ANY.RUN assesses with high confidence that the developer also built the Gabagool credential-phishing kit (active since April 2026). It is unknown whether one operator or several customers run it.

Summary written from the sources below. Check the originals before acting.

Known so far

5/6

high

no CVSS yet; severity from the sources

known so far5 of 6

missing: primary source

First public: Oct 27, 2026 UTC
Last modified: Oct 28, 2026
Status: open
Known exploitation: Yes
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-28 11:14 UTC. All times on this page are UTC.

Who is affected

2 products

Product	Ecosystem	Affected	Fixed in
Microsoft 365	vendor	accounts where the OAuth device code flow is allowed	–
Microsoft Entra ID	vendor	tenants that do not block the device code flow	–

Who cares: campaign, device-code, early-warning, microsoft-365, phishing
Not affected if: –

How to check

In Entra ID sign-in logs, look for sign-ins with authentication protocol 'deviceCode' that users did not expect, especially soon after they opened an emailed document.
In proxy or DNS logs, look for URLs with /session_public.php?action=start or action=poll, /assets/php/endpoints/confirm_visit.php, /js/client_geo.js, /js/url_helper.js, /js/endpoint.js, /assets/private_captcha/public/widget.js?v=4, or /admin/index.php on the same host.
Look for landing tokens matching zt[A-Za-z0-9]{32}op or it[A-Za-z0-9]{32}us.
Check for these hosts: 5200m[.]com/kvme2/, torvion[.]life/ofulium/, ghethim[.]com/hyllen/, goldcreekconcrete[.]com, goldcreekconcrete[.]org, priorispace[.]biz, and IP 172.86.85[.]51.
Look for emails with password-protected attachments where the password is in the message body.

Know the next one before it finds you.

Add to Slack

SkyW4lker device-code phishing kit takes over Microsoft 365 accounts without stealing passwords, mainly at US companies

Summary written from the sources below. Check the originals before acting.

Product

Ecosystem

Affected

Fixed in

Microsoft 365

vendor

accounts where the OAuth device code flow is allowed

–

Microsoft Entra ID

vendor

tenants that do not block the device code flow

–

SkyW4lker device-code phishing kit takes over Microsoft 365 accounts without stealing passwords, mainly at US companies

Who is affected

How to check

Know the next one before it finds you.

SkyW4lker device-code phishing kit takes over Microsoft 365 accounts without stealing passwords, mainly at US companies

Who is affected

How to check

Know the next one before it finds you.

The fix

Who had it, and when

Sources