Phishing · 1 source · latest 2h

SkyW4lker phishing kit hijacks Microsoft 365 accounts via device-code sign-ins

PHISHINGMicrosoft 365redteam/daily · 1 source

Severity: High
Sources: 1

What happened

SkyW4lker is a device-code phishing kit that abuses Microsoft's OAuth 2.0 device-code flow to obtain valid Microsoft 365 tokens, so passwords and MFA are not directly bypassed. Lures are password-protected attachments posing as contracts or invoices, with links hosted on trusted platforms such as Google Sites and Zoom to evade reputation checks. ANY.RUN tracked 618 sandbox analyses between June and 21 October 2026, with US submitters accounting for roughly 46 to 47 per cent, and assesses with high confidence that the same developer built the related Gabagool kit.

For IT people · Written by AI from 1 source · Wrong?

What to do

Review whether device-code authentication is allowed broadly in your Microsoft 365 tenant and restrict it where it is not required.
Warn staff not to enter codes from unexpected or unsolicited sign-in requests, even on genuine Microsoft login pages.
Treat password-protected attachments with the password in the email body as a phishing risk and verify them through another channel.

Written by AI from the sources, checked against them

Read the full story at the source