Skyw4lker device-code phishing targets US Microsoft 365 accounts
Original title: American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed
Password-protected contract lures and Google Sites lead victims into a real Microsoft login that hands over tokens.
ANY.RUN describes Skyw4lker, a device-code phishing campaign aimed mainly at US organizations in manufacturing, technology, and healthcare. Victims get a password-protected document posed as a contract or service proposal, then a sites.google.com page that leads into a legitimate Microsoft authentication flow. Completing that flow can give the attacker Microsoft 365 tokens without a fake login page. The kit uses obfuscated JavaScript and a PHP backend that creates a session, collects IP and geolocation, and polls until authentication finishes. The report is an analysis and detection write-up, not a list of named victim companies.
Unconfirmed: Named victim organizations and the campaign’s full scale are not stated.
- Sectors named are manufacturing, technology, and healthcare in the United States.
- The lure is a password-protected document styled as a contract or proposal.
- Redirects use sites.google.com into Microsoft 365 device authorization.
- The backend collects IP address and geolocation while polling for login completion.
- FBI figures in the piece are general 2024–2025 phishing context, not Skyw4lker totals.
Impact: Microsoft 365 tokens and account access without a fake login page
- 1.Review Microsoft 365 sign-ins tied to unexpected device-code or document lures.
- 2.Treat password-protected contract files that redirect to sites.google.com as suspicious.
- Products
- Microsoft 365
- Malware
- Skyw4lker
- Organizations
- ANY.RUN
- Countries
- United States
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | sites.google.com | he document, the victim is directed toward a page hosted on sites[.]google[.]com , which eventually leads into a Microsoft authenticatio |
From the original article
7 min read at thehackernews.com
Modern phishing campaigns can compromise American businesses without relying on traditional credential theft. Attackers can abuse legitimate cloud services, authentication mechanisms, and trusted business workflows to gain access to corporate accounts while leaving fewer obvious signs behind. ANY.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.