{"id":"CMP-202610-skyw4lker-device-code-phishing-kit-takes-over-microsoft-365-","kind":"campaign","aliases":[],"related":[],"title":"SkyW4lker device-code phishing kit takes over Microsoft 365 accounts without stealing passwords, mainly at US companies","description":null,"summary":"SkyW4lker (also SkyW4lker x365 Sentinel) is an active phishing kit. Victims get an email with a password-protected PDF, DOCX or XLSX attachment, and the password is in the email body. The lures are contracts, invoices and service proposals. The document links to a CAPTCHA page, sometimes by way of a lure on Google Sites, Miro or Zoom. The final page asks the victim to enter a device code on Microsoft's real login page. That gives the attacker tokens for the Microsoft 365 account. No password is stolen, and MFA does not stop it. ANY.RUN (2026-10-27) counted 618 sandbox analyses from 2026-06-23 to 2026-10-21, rising from 20 a month in June to 200 in September. About 46% came from the US, then India, Canada and the UK. Targets are mainly technology, manufacturing, government and healthcare. ANY.RUN assesses with high confidence that the developer also built the Gabagool credential-phishing kit (active since April 2026). It is unknown whether one operator or several customers run it.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-28T11:14:53+00:00","products":[{"name":"Microsoft 365","fixed":[],"affected":"accounts where the OAuth device code flow is allowed","ecosystem":"vendor"},{"name":"Microsoft Entra ID","fixed":[],"affected":"tenants that do not block the device code flow","ecosystem":"vendor"}],"ecosystems":[],"tags":["campaign","device-code","early-warning","microsoft-365","phishing"],"not_affected_if":[],"how_to_check":"- In Entra ID sign-in logs, look for sign-ins with authentication protocol 'deviceCode' that users did not expect, especially soon after they opened an emailed document.\n- In proxy or DNS logs, look for URLs with /session_public.php?action=start or action=poll, /assets/php/endpoints/confirm_visit.php, /js/client_geo.js, /js/url_helper.js, /js/endpoint.js, /assets/private_captcha/public/widget.js?v=4, or /admin/index.php on the same host.\n- Look for landing tokens matching zt[A-Za-z0-9]{32}op or it[A-Za-z0-9]{32}us.\n- Check for these hosts: 5200m[.]com/kvme2/, torvion[.]life/ofulium/, ghethim[.]com/hyllen/, goldcreekconcrete[.]com, goldcreekconcrete[.]org, priorispace[.]biz, and IP 172.86.85[.]51.\n- Look for emails with password-protected attachments where the password is in the message body.","fix":"- Use an Entra ID Conditional Access authentication-flows policy to block the device code flow for all users, except named accounts that need it (for example meeting-room devices).\n- If you find a suspicious device-code sign-in, revoke that user's sessions and refresh tokens, review their mailbox rules and OAuth app consents, and look at what was accessed.\n- Warn staff that a document or web page asking them to type a code at microsoft.com/devicelogin is phishing.\n- Block the listed domains and IP at the mail gateway and proxy.","status":"open","published_at":"2026-10-27T00:00:00+00:00","first_seen_at":"2026-10-28T11:14:53+00:00","triaged_at":"2026-10-28T11:14:53+00:00","updated_at":"2026-10-28T11:14:53+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-06':156B '-10':148B,160B '-202610':20A '-21':161B '-23':157B '-27':149B '-365':48B '20':164B '200':170B '2026':147B,155B,159B,212B '365':10A,30A,36A,134B '46':174B '618':151B 'account':11A,135B 'activ':57B,209B 'also':51B,201B 'analys':153B 'any.run':146B,193B 'april':211B 'ask':112B 'assess':194B 'attach':73B 'attack':129B 'bodi':81B 'built':202B 'came':175B 'campaign':40B 'canada':181B 'captcha':95B 'cmp':19A 'code':4A,24A,43B,119B 'compani':18A 'confid':197B 'contract':85B 'count':150B 'credenti':206B 'credential-phish':205B 'custom':221B 'develop':200B 'devic':3A,42B,118B 'device':23A 'device-cod':2A,41B 'document':91B 'docx':70B 'earli':45B 'early-warn':44B 'email':63B,80B 'enter':116B 'entra':38A 'final':110B 'gabagool':204B 'get':61B 'give':127B 'googl':104B 'govern':190B 'healthcar':192B 'high':196B 'id':39A 'india':180B 'invoic':86B 'june':168B 'kit':6A,26A,59B,208B 'link':92B 'login':124B 'lure':83B,102B 'main':15A,187B 'manufactur':189B 'mfa':141B 'microsoft':9A,29A,35A,37A,47B,121B,133B 'miro':106B 'month':166B 'one':217B 'oper':218B 'over':28A 'page':96B,111B,125B 'password':14A,67B,76B,137B 'password-protect':66B 'pdf':69B 'phish':5A,49B,58B,207B 'phishing':25A 'propos':89B 'protect':68B 'real':123B 'rise':162B 'run':222B 'sandbox':152B 'sentinel':34A,54B 'septemb':172B 'servic':88B 'sever':220B 'sinc':210B 'site':105B 'skyw4lker':1A,22A,31A,32A,50B,52B 'skyw4lker-device-code-phishing-kit-takes-over-microsoft':21A 'sometim':97B 'steal':13A 'stolen':139B 'stop':144B 'take':7A 'takes':27A 'target':185B 'technolog':188B 'token':130B 'uk':184B 'unknown':215B 'us':17A,178B 'victim':60B,114B 'warn':46B 'way':99B 'whether':216B 'without':12A 'x365':33A,53B 'xlsx':72B 'zoom':108B","nicknames":["SkyW4lker","SkyW4lker x365 Sentinel"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-skyw4lker-device-code-phishing-kit-takes-over-microsoft-365-","url":null,"severity":null,"published_at":"2026-10-27T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-28T11:14:53+00:00","fetched_at":"2026-10-28T11:14:53+00:00","note":null}],"documents":[{"id":10131,"url":"https://x.com/TheHackersNews/status/2115393292942692712","title":"@TheHackersNews: 🚨 Skyw4lker phishing campaign targets U.S. firms using Microsoft 365 device code","kind":"post","source":"x","text":"🚨 Skyw4lker phishing campaign targets U.S. firms using Microsoft 365 device code phishing.\n\nNo password theft required.\n\nAttackers use fake business documents and Google Sites to trick victims into authorizing access to their Microsoft 365 accounts.\n\nHow the attack works ↓ https://t.co/LQAJsdMesr\n\nlikes 18 reposts 10","published_at":"2026-10-28T10:40:37+00:00","relation":"describes","confidence":null,"note":null},{"id":10228,"url":"https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/","title":"SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises (ANY.RUN)","kind":"blog","source":"analyst","text":"ANY.RUN: SkyW4lker (SkyW4lker x365 Sentinel) device-code phishing kit targeting Microsoft 365 users (US 46-47%, also Europe, India, Canada, UK; technology, manufacturing, government, healthcare). 618 sandbox analyses June-21 Oct 2026, 20/month in June to 200 in September; first seen 23 June 2026. Delivery: phishing email with password-protected PDF/DOCX/XLSX attachment (password in body; lures: contracts, invoices, proposals) -> CAPTCHA page, sometimes lure on Google Sites, Miro, Zoom -> page asking victim to enter device code at Microsoft's real login page. PHP backend + obfuscator.io JS. URL patterns: /session_public.php?action=start|poll, /assets/php/endpoints/confirm_visit.php, /js/url_helper.js, /js/endpoint.js, /js/client_geo.js, php/endpoints/accounts.php, /assets/private_captcha/public/widget.js?v=4, admin panel /admin/index.php. Landing tokens zt[A-Za-z0-9]{32}op, it[A-Za-z0-9]{32}us. Geo via ip-api.com, ipapi.co, ipwho.is. Hosts: 5200m[.]com/kvme2/, torvion[.]life/ofulium/, ghethim[.]com/hyllen/, goldcreekconcrete[.]com, goldcreekconcrete[.]org; mostly DigitalOcean; shared IP 172.86.85[.]51 (priorispace[.]biz). Same developer as Gabagool credential phishing kit (since April 2026), high confidence.","published_at":"2026-10-27T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}