SkyW4lker phishing kit abuses Microsoft 365 device-code login
Original title: SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises
ANY.RUN linked 618 analyses from June through October 21, 2026, with monthly cases rising from 20 to 200.
ANY.RUN describes SkyW4lker, also called SkyW4lker x365 Sentinel, as an active device-code phishing kit aimed at Microsoft 365 users in the United States, Europe, and other regions. Password-protected email attachments lead through CAPTCHA and decoy pages to a prompt that asks victims to enter a device code on Microsoft's legitimate authentication page, which can grant account access without stealing the password or bypassing MFA. The kit uses a PHP backend and obfuscated JavaScript, with IP geolocation and polling for completed logins. ANY.RUN assesses with high confidence that it shares a developer with the Gabagool kit, active since April 2026.
Unconfirmed: Financial motivation is described as possible, and the shared-developer assessment is ANY.RUN's high-confidence judgment.
- About 46 to 47 percent of sandbox submissions came from the United States.
- Submitters were often in technology, manufacturing, and government, including India, Canada, and the United Kingdom.
- Lures include contracts, invoices, and proposals as PDF, DOCX, or spreadsheet attachments.
- The kit shares JavaScript modules, landing-URL format, and some hosting with Gabagool.
Impact: Unauthorized access to Microsoft 365 accounts and related data
| Product | Affected |
|---|---|
| Microsoft 365 | — |
- 1.Treat password-protected email attachments that later request a Microsoft device code as phishing.
- 2.Review Microsoft 365 device-code sign-ins that follow invoice or contract lures.
- Vendors
- Microsoft
- Products
- Microsoft 365
- Organizations
- ANY.RUN
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 5200m.com | Za-z0-9]{32}us from 5 August Same directory on shared hosts 5200m[.]com/kvme2/ (16 Oct), torvion[.]life/ofulium/ (5 Oct), ghethim |
| domain | chickenkiller.com | s to host phishing pages using flow505.mooo[.]com, bigbrain.chickenkiller[.]com and off365acess.jumpingcrab[.]com. Resource Development T |
| domain | csr-rooflng.com | in chains, e.g. sdocshares.auth.outlook2026common.copilos26.csr-rooflng[.]com and pdocshared.payments2026.outlooks.common.ecmholdlnggro |
| domain | ecmholdlnggroup.com | r-rooflng[.]com and pdocshared.payments2026.outlooks.common.ecmholdlnggroup[.]com. Resource Development T1583.001 Acquire Infrastructure: D |
| domain | ghethim.com | 00m[.]com/kvme2/ (16 Oct), torvion[.]life/ofulium/ (5 Oct), ghethim[.]com/hyllen/ (28 Sep – 2 Oct) 5200m[.]com/kvme2/ (15 Oct), tor |
| domain | goldcreekconcrete.com | ged gabagool load the kit from directories named skywalker: goldcreekconcrete[.]com/example/skywalker/ ( sandbox session ) and goldcreekconcr |
| domain | goldcreekconcrete.org | ekconcrete[.]com/skywalker/example/ ( sandbox session ). On goldcreekconcrete[.]org, which also hosted Gabagool ( sandbox session ), the dire |
| domain | google.ie | Google Sites, Axure Cloud and Smartsheet pages and the maps.google[.]ie/url?q= redirect, e.g. sites.google[.]com/heatherrasekhome |
| domain | ipapi.co | m from the response of one of three services: ip-api[.]com, ipapi[.]co or ipwho[.]is. The location can also be obtained through |
| domain | ipwho.is | ponse of one of three services: ip-api[.]com, ipapi[.]co or ipwho[.]is. The location can also be obtained through the PHP endpoi |
| domain | jumpingcrab.com | 05.mooo[.]com, bigbrain.chickenkiller[.]com and off365acess.jumpingcrab[.]com. Resource Development T1583.003 Acquire Infrastructure: V |
| domain | linodeobjects.com | ]dev/docsonedrive2026.html, carcabaoperadologistca.fr-par-1.linodeobjects[.]com/document_excel.html and bethom-contracting-llc.mintlify[. |
| domain | mintlify.site | bjects[.]com/document_excel.html and bethom-contracting-llc.mintlify[.]site. Initial Access T1566.001 Phishing: Spearphishing Attachm |
| domain | mooo.com | dynamic-DNS subdomains to host phishing pages using flow505.mooo[.]com, bigbrain.chickenkiller[.]com and off365acess.jumpingcrab |
| domain | obfuscator.io | 65 / OAuth credentials Capabilities JavaScript obfuscation (obfuscator.io), Device-Code phishing, Geolocation detection, IP-address d |
| domain | priorispace.biz | DigitalOcean mostly DigitalOcean; shared IP 172.86.85[.]51 (priorispace[.]biz) Main endpoint session_public.php (device-code phishing) |
| domain | r2.dev | nd site builders, e.g. pub-177b3aa5a54d4f9087a649de5ec766d5.r2[.]dev/docsonedrive2026.html, carcabaoperadologistca.fr-par-1.li |
| domain | torvion.life | Same directory on shared hosts 5200m[.]com/kvme2/ (16 Oct), torvion[.]life/ofulium/ (5 Oct), ghethim[.]com/hyllen/ (28 Sep – 2 Oct) |
| ipv4 | 162.243.64.121 | DigitalOcean hosting (50 of 92 backend IP addresses), e.g. 162.243.64[.]121 and 67.205.154[.]32. Resource Development T1608.005 Stage |
| ipv4 | 172.86.85.51 | Hosting mostly DigitalOcean mostly DigitalOcean; shared IP 172.86.85[.]51 (priorispace[.]biz) Main endpoint session_public.php (dev |
| sha256 | 9aa0b87974b9b4cd42603833b7ad44257578467d279b315a071108a5ed02c268 | rotected.pdf or DOC <10 random characters>.pdf, e.g. SHA256 9aa0b87974b9b4cd42603833b7ad44257578467d279b315a071108a5ed02c268. Initial Access T1566.002 Phishing: Spearphishing Link The |
From the original article
11 min read at any.run
SkyW4lker (SkyW4lker x365 Sentinel) is an active device-code phishing kit targeting Microsoft 365 users in the United States, Europe, and other regions. By abusing Microsoft’s legitimate authentication process, the kit can give attackers access to corporate accounts without stealing passwords or bypassing MFA. This puts business emails, sensitive documents, and other Microsoft 365 resources at […]
By ShiFu · any.run
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.