SkyW4lker Phishing Kit Exploits Microsoft Device Code Authentication to Bypass MFA
A sophisticated phishing kit named SkyW4lker is actively targeting US corporate accounts by leveraging Microsoft's legitimate device-code authentication process to bypass multi-factor authentication and steal credentials.
Cybercriminals are increasingly targeting enterprise accounts by exploiting legitimate authentication mechanisms, as demonstrated by the active SkyW4lker phishing kit. This sophisticated operation focuses on compromising Microsoft 365 accounts by tricking users into authorizing malicious access through Microsoft's own device-code authentication flow. Researchers observed a significant number of related sandbox analyses, with a substantial portion originating from the United States, indicating a focused campaign against American businesses.
The attack chain begins with phishing emails that are carefully crafted to appear as legitimate business documents, such as contracts or proposals. Victims are often guided through CAPTCHA checks and directed to trusted platforms, including a legitimate Microsoft authentication page. The crucial step involves the victim entering a device code provided by the attacker into this legitimate Microsoft portal. This action, when performed by an unsuspecting user, grants the attackers unauthorized access to their corporate accounts without the need to steal passwords or bypass traditional multi-factor authentication (MFA) prompts.
Security researchers utilized advanced sandbox analysis tools to uncover the full scope of the SkyW4lker campaign. By analyzing suspicious activity within these controlled environments, they were able to connect the phishing kit to additional malicious infrastructure and identify technical links to other known phishing operations, such as Gabagool. This ability to quickly pivot from a single suspicious URL to a broader threat landscape significantly reduces the manual effort required for threat hunting and incident response.
The threat intelligence gathered from these investigations revealed that organizations across various sectors, including technology, government, education, consulting, and healthcare, have been targeted. The geographical distribution of the attack attempts further highlights the global reach and the specific focus on US-based entities. The associated indicators of compromise (IOCs) can be used by security teams to enrich their detection systems and proactively hunt for connected threats within their networks.
To mitigate the risks posed by SkyW4lker and similar attacks, organizations are advised to restrict unnecessary device-code authentication through Microsoft Entra Conditional Access policies. Furthermore, security teams should investigate suspicious indicators that extend beyond the initial alert, looking for connected infrastructure and related threat activity. The use of sandbox analysis tools with features like Related Threat Context can provide SOC teams with the necessary intelligence to identify potential exposure and contain threats more effectively, thereby reducing the risk of costly security incidents.
Beyond the SkyW4lker campaign, the threat landscape in October 2026 also saw a rise in fake AI campaigns impersonating popular services like ChatGPT and Claude. These campaigns aim to steal Microsoft 365 and Google account access through fraudulent downloads and deceptive event invitations. In one instance, a seemingly genuine Claude installer was found to be running hidden processes that stole browser session cookies, potentially allowing attackers to gain access to business accounts without triggering further MFA prompts.
Another notable threat is the GeorgeGinx Phishing-as-a-Service (PhaaS) operation, which targets US government, banking, healthcare, and IT organizations. This operation exploits legitimate Adobe Shared Links to redirect victims to Microsoft Device Code phishing pages, mirroring the attack vector used by SkyW4lker. The use of trusted services like Adobe to mask malicious redirects underscores the evolving tactics of cybercriminals in evading detection.
Finally, the WKLP malware, a Python-based infostealer and remote access trojan (RAT), has been observed targeting US and French government organizations. WKLP is designed to steal credentials, browser data, and sensitive files, while also enabling attackers to maintain persistent remote access to compromised systems. Its ability to disable Microsoft Defender further complicates detection and removal efforts, highlighting the need for robust endpoint security solutions and continuous monitoring.