SkyW4lker phishing kit hijacks Microsoft 365 accounts via device-code sign-ins
- Severity
- High
- Sources
- 1
What happened
SkyW4lker (also branded SkyW4lker x365 Sentinel), first seen 23 June 2026, is a device-code phishing kit that abuses the Microsoft OAuth 2.0 device-code flow to obtain access tokens for Microsoft 365 without password theft or MFA bypass. Lures use password-protected PDF, DOCX, XLSX or EML attachments with the password in the body, and redirects hosted on Google Sites, Miro, Zoom, Smartsheet, Axure Cloud and similar services. ANY.RUN links it to the Gabagool kit (active since April 2026) through shared JavaScript modules and hosting patterns. Defenders should restrict device-code authentication where it is not needed, since the article states MFA alone will not stop this attack where it is broadly allowed, and should hunt for unexpected device-code sign-ins.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Review whether device-code authentication is allowed broadly in your Microsoft 365 tenant and restrict it where it is not required.
- Warn staff not to enter codes from unexpected or unsolicited sign-in requests, even on genuine Microsoft login pages.
- Treat password-protected attachments with the password in the email body as a phishing risk and verify them through another channel.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Companies
Products