SkyW4lker phishing kit abuses Microsoft 365 device-code flow for account takeovers
Original title: SkyW4lker Phishing Campaign Expands, Threatening US Enterprises with Microsoft 365 Account Takeovers
SkyW4lker has tracked 618 sandbox analyses since June 2026 with nearly half from the United States targeting Microsoft 365 sessions.
The SkyW4lker phishing kit tricks users into approving legitimate Microsoft device-code sign-ins instead of stealing passwords or bypassing MFA. Delivery uses password-protected attachments on legitimate platforms like Google Sites and Miro. The kit links to Gabagool and primarily hits US tech manufacturing and government organizations.
- Active since June 2026 with monthly submissions rising to 200 in September
- 46-47 percent of submissions from the United States
- Abuses OAuth 2.0 device-code flow for valid Microsoft 365 sessions
- Shares DNA with Gabagool credential phishing kit
Impact: Unauthorized access to Microsoft 365 accounts and connected apps
- Vendors
- Microsoft
- Products
- Microsoft 365
- Malware
- SkyW4lker
- Organizations
- ANY.RUN
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 5200m.com | Same tokens, it…us from Aug 5 Shared hosts and directories 5200m[.]com/kvme2/, torvion[.]life/ofulium/, ghethim[.]com/hyllen/ Sa |
| domain | chickenkiller.com | s.common.ecmholdlnggroup[.]com flow505.mooo[.]com, bigbrain.chickenkiller[.]com, off365acess.jumpingcrab[.]com 172.86.85[.]51 (priorispac |
| domain | csr-rooflng.com | r/ directories) sdocshares.auth.outlook2026common.copilos26.csr-rooflng[.]com pdocshared.payments2026.outlooks.common.ecmholdlnggroup[. |
| domain | ecmholdlnggroup.com | 6.csr-rooflng[.]com pdocshared.payments2026.outlooks.common.ecmholdlnggroup[.]com flow505.mooo[.]com, bigbrain.chickenkiller[.]com, off365a |
| domain | ghethim.com | nd directories 5200m[.]com/kvme2/, torvion[.]life/ofulium/, ghethim[.]com/hyllen/ Same directories, within days of each other Hosti |
| domain | goldcreekconcrete.com | from directories literally named skywalker and skyw4lker on goldcreekconcrete[.]com and goldcreekconcrete[.]org. ANY.RUN’s assessment: the sa |
| domain | goldcreekconcrete.org | amed skywalker and skyw4lker on goldcreekconcrete[.]com and goldcreekconcrete[.]org. ANY.RUN’s assessment: the same developer built both kits |
| domain | google.ie | hing Link Google Sites, Axure Cloud, Smartsheet pages; maps.google[.]ie/url?q= redirects Execution T1204.001 Malicious Link Victi |
| domain | ipapi.co | _geo.js Fingerprints the visitor’s location via ip-api.com, ipapi.co, or ipwho.is (or a server-side client_geo.php). Used to pro |
| domain | jumpingcrab.com | ow505.mooo[.]com, bigbrain.chickenkiller[.]com, off365acess.jumpingcrab[.]com 172.86.85[.]51 (priorispace[.]biz), 162.243.64[.]121, 67. |
| domain | microsoftonline.com | al Access T1528 Steal Application Access Token Abuses login.microsoftonline[.]com/common/oauth2/deviceauth while polling action=poll Collec |
| domain | mooo.com | .payments2026.outlooks.common.ecmholdlnggroup[.]com flow505.mooo[.]com, bigbrain.chickenkiller[.]com, off365acess.jumpingcrab[.] |
| domain | priorispace.biz | killer[.]com, off365acess.jumpingcrab[.]com 172.86.85[.]51 (priorispace[.]biz), 162.243.64[.]121, 67.205.154[.]32 Sample lure SHA256: 9 |
| domain | torvion.life | from Aug 5 Shared hosts and directories 5200m[.]com/kvme2/, torvion[.]life/ofulium/, ghethim[.]com/hyllen/ Same directories, within |
| ipv4 | 162.243.64.121 | acess.jumpingcrab[.]com 172.86.85[.]51 (priorispace[.]biz), 162.243.64[.]121, 67.205.154[.]32 Sample lure SHA256: 9aa0b87974b9b4cd4260 |
| ipv4 | 172.86.85.51 | Hosting Mostly DigitalOcean Mostly DigitalOcean; shared IP 172.86.85[.]51 Main endpoint session_public.php (device-code flow) accou |
| ipv4 | 67.205.154.32 | .]com 172.86.85[.]51 (priorispace[.]biz), 162.243.64[.]121, 67.205.154[.]32 Sample lure SHA256: 9aa0b87974b9b4cd42603833b7ad442575784 |
| sha256 | 9aa0b87974b9b4cd42603833b7ad44257578467d279b315a071108a5ed02c268 | biz), 162.243.64[.]121, 67.205.154[.]32 Sample lure SHA256: 9aa0b87974b9b4cd42603833b7ad44257578467d279b315a071108a5ed02c268 Conclusion SkyW4lker is not a novel exploit; it is a well-e |
From the original article
12 min read at cybersecuritynews.com
A phishing kit called SkyW4lker (also branded SkyW4lker x365 Sentinel) is quietly taking over Microsoft 365 accounts without ever stealing a password. Instead of cracking logins or breaking MFA, it tricks employees into approving a legitimate Microsoft device-code sign-in, handing attackers a valid session to corporate mailboxes, documents, and connected apps. The kit has been […]
By Balaji N · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.