SkyW4lker phishing kit abuses Microsoft 365 device-code flow for account takeovers
SkyW4lker has tracked 618 sandbox analyses since June 2026 with nearly half from the United States targeting Microsoft 365 sessions.
Stories per day · 30 days
5 RSS
Relatedmicrosoft-3653phishing3eviltokens2oauth2aitm-phishing1business-email-compromise1cogui1entra1health-isac1iron-man1itdr1mfa1microsoft1passkeys1phishing-as-a-service1skyw4lker1storm-29901storm-29921
12 stories, newest first · one card per story
Stories tagged #device-code
Token replay gave attackers Microsoft 365 access at 79 organizations
Huntress logged 497 successful sign-ins and over 200,000 failures from July 14 to September 22, 2026.
2
Opinion: EvilTokens shows AI speeding Microsoft 365 device-code phishing
Microsoft said it disrupted Storm-2992 in September after the service, found in February, used AI across the chain.
1
Passkeys Raise the Bar. Here’s Where Attackers Can Still Get In.
Huntress says the EvilTokens device-code phishing kit hit 344 organizations without breaking passkey cryptography.
Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem
Microsoft and partners seized Chinese-language phishing-kit infrastructure that sent more than one billion messages.
Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia
Wazza phishkit uses staged routing and Adobe device-code lures against banking, government, and manufacturers.
US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access
US-focused CSuite phishing steals Microsoft 365 sessions and installs RMM tools for persistent access.
How US SOCs and MSSPs Can Use Threat Intelligence to Detect Phishing Infrastructure Earlier
ANY.RUN says OAuth device-code phishing jumped 483.7% in H1 2026.
Microsoft Warns of EvilTokens AI Phishing Service Hijacking Thousands of Accounts
EvilTokens PaaS hijacks device-code auth to steal tokens and enable BEC at scale, compromising 12,000+ inboxes across 10,000+ organizations.
2
Microsoft Disrupts EvilTokens Device Code Phishing Service
Microsoft seized 50 sites and disabled over 150 domains used by EvilTokens to phish Microsoft 365 accounts.
UK Cops arrest 2 EvilTokens suspects, Microsoft seizes 50 phishing kit websites
UK police arrested two EvilTokens admins as Microsoft seized sites used to phish over 12,000 inboxes.
1
Hackers Use Passkey-Themed Phishing to Hijack Microsoft 365 Accounts and Steal Cloud Data
Microsoft reports passkey-themed phishing campaigns hijacking Microsoft 365 accounts via AiTM and device-code flows, then exfiltrating cloud data.
3