Skip to content
NewA calmer, faster ZeroHour
StoryPhishing & fraudhighExploited in the wild

Skyw4lker Device-Code Phishing Hits US and Canadian Firms

3 sources · 3 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Skyw4lker device-code phishing and voice phishing compromise Microsoft 365 accounts at US and Canadian organizations.

ANY.RUN and the Canadian Centre for Cyber Security report Skyw4lker device-code phishing, where password-protected documents redirect to sites.google.com for legitimate Microsoft authentication to steal tokens. The campaign targets US manufacturing, technology, and healthcare firms. Separately, the Canadian Centre warns of an ongoing voice-phishing campaign impersonating IT support at Canadian legal and financial organizations, enabling MFA registration and data theft via Graph API. ANY.RUN notes 618 analyses of Skyw4lker and related kits like GeorgeGinx and Mir0Auth from June to October 2026.

Key facts
  • Targets US manufacturing, technology, healthcare organizations
  • Password-protected documents lead to sites.google.com Microsoft flows
  • Actors register own MFA methods and exfiltrate data
  • Voice phishing directs Canadian firms to branded relay pages
  • 618 sandbox analyses of Skyw4lker from June to October 2026
  • Related kits: GeorgeGinx and Mir0Auth
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 28, 2026Canadian Centre issues AL26-028 on voice phishing · Canadian Centre for Cyber Security
  2. Oct 28, 2026Hacker News reports Skyw4lker device code phishing · The Hacker News
  3. Nov 3, 2026ANY.RUN reports Skyw4lker and related campaigns · ANY.RUN

What each outlet adds

beyond the shared facts
  • The Hacker NewsDetails Skyw4lker token theft via Google Sites for US sectors
  • Canadian Centre for Cyber SecurityVoice phishing targeting Canadian legal and financial firms since January
  • ANY.RUN618 analyses of Skyw4lker plus GeorgeGinx and Mir0Auth kits
Vendors
MicrosoftGoogle
Products
Microsoft 365SharePointOneDriveMicrosoft Teams
Threat actors
SkyW4lker
Malware
Skyw4lkerGeorgeGinxMir0AuthWKLP
Victims
US enterprises
Organizations
Canadian Centre for Cyber SecurityANY.RUN
Countries
CanadaUnited StatesUS

Coverage

oldest first · one row per article · UTC
  1. · 6d ago The Hacker NewsFirst report

    Skyw4lker device-code phishing targets US Microsoft 365 accounts

    Password-protected contract lures and Google Sites lead victims into a real Microsoft login that hands over tokens.

  2. · 5d ago Canadian Centre for Cyber Security

    Canadian help-desk vishing campaign bypasses MFA in real time

    Callers send staff to branded relay pages, then register MFA methods and steal Microsoft 365 data before extortion.

  3. · 3h ago ANY.RUN

    SkyW4lker phishing kit abuses Microsoft device-code authentication

    SkyW4lker, GeorgeGinx and Mir0Auth compromise Microsoft 365 accounts via legitimate device-code flows in October 2026.