SkyW4lker phishing kit hijacks Microsoft 365 accounts via device-code sign-ins
PHISHINGMicrosoft 365redteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
A phishing kit called SkyW4lker tricks employees into approving a genuine Microsoft sign-in code, which gives attackers access to their work email and files without stealing a password. The kit has been active since June 2026 and is spreading quickly, with nearly half of the samples analysed coming from the United States.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Review whether device-code authentication is allowed broadly in your Microsoft 365 tenant and restrict it where it is not required.
- Warn staff not to enter codes from unexpected or unsolicited sign-in requests, even on genuine Microsoft login pages.
- Treat password-protected attachments with the password in the email body as a phishing risk and verify them through another channel.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Companies
Products