Ethical Hacking News
The Skyw4lker campaign is a sophisticated phishing attack that utilizes legitimate authentication mechanisms to bypass traditional security controls. The attackers begin by sending business-themed documents, often presented as contract or service proposals, to the victim. The document is password-protected, and upon opening, the victim is redirected to a page hosted on Google's infrastructure, which eventually leads to a Microsoft authentication flow. The attacker does not need to reproduce Microsoft's login experience perfectly; the deception lies in convincing the victim to complete the authentication request initiated by the attacker. The investigation into the Skyw4lker campaign requires tracing the authentication flow and supporting infrastructure, extracting reliable indicators, and turning those findings into detections that can protect the wider organization.
The Skyw4lker campaign is a sophisticated phishing attack targeting US-based organizations in the manufacturing, technology, and healthcare sectors. The attackers use legitimate authentication mechanisms to bypass traditional security controls, making it challenging to detect the attack. The attackers send business-themed documents, password-protected and hosted on Google's infrastructure, which leads to a Microsoft authentication flow. The attackers obtain Microsoft 365 tokens, which can be used to access sensitive information and resources. The scale of phishing in the US is staggering, with 1 million complaints in 2025 and reported losses exceeding $20.9 billion. The attackers are adapting to organizations with heavy investment in identity security and MFA, using device code phishing tactics.
The cybersecurity landscape has witnessed an alarming rise in sophisticated phishing attacks in recent years, with attackers exploiting the trust of organizations to compromise sensitive information and resources. A recent threat intelligence report has shed light on a particularly insidious campaign, dubbed Skyw4lker, which has been targeting US-based organizations in the manufacturing, technology, and healthcare sectors.
The Skyw4lker campaign, analyzed by threat intelligence firm ANY.RUN, employs a novel tactic that utilizes legitimate authentication mechanisms to bypass traditional security controls. The attackers initiate a legitimate device authorization flow, convincing the victim to complete it, and then obtain access to the resulting Microsoft 365 tokens. This approach makes it challenging for security teams to detect the attack, as the authentication event appears legitimate.
The attackers begin by sending business-themed documents, often presented as contract or service proposals, to the victim. The document is password-protected, and upon opening, the victim is redirected to a page hosted on Google's infrastructure, which eventually leads to a Microsoft authentication flow. The attacker does not need to reproduce Microsoft's login experience perfectly; the deception lies in convincing the victim to complete the authentication request initiated by the attacker.
Once the authentication process is completed, the attacker can obtain access to the resulting Microsoft 365 tokens. The web infrastructure used by Skyw4lker provides additional evidence of the campaign's operation, featuring obfuscated JavaScript and a PHP backend. The attackers use this infrastructure to create a victim session, collect information such as IP address and geolocation, and repeatedly poll the backend while waiting for the authentication process to complete.
The investigation into the Skyw4lker campaign requires tracing the authentication flow and supporting infrastructure, extracting reliable indicators, and turning those findings into detections that can protect the wider organization. Device code phishing is one example of how attackers are adapting to organizations that have invested heavily in identity security and MFA.
The scale of phishing in the United States is staggering, with the FBI's Internet Crime Complaint Center recording 193,407 phishing and spoofing complaints in 2024. The number of complaints increased to 1 million in 2025, with reported losses exceeding $20.9 billion, a 26% increase compared to the previous year.
The Skyw4lker campaign is just one of many phishing attacks that have been targeting US organizations in recent years. The FBI's Internet Crime Complaint Center reported 193,407 phishing and spoofing complaints in 2024, with the number increasing to 1 million in 2025. The reported losses in 2025 exceeded $20.9 billion, a 26% increase compared to the previous year.
The attackers are adapting to organizations that have invested heavily in identity security and MFA. They are using legitimate authentication mechanisms to bypass traditional security controls. The attackers initiate a legitimate device authorization flow, convincing the victim to complete it, and then obtain access to the resulting Microsoft 365 tokens.
The investigation into the Skyw4lker campaign requires tracing the authentication flow and supporting infrastructure, extracting reliable indicators, and turning those findings into detections that can protect the wider organization. Device code phishing is one example of how attackers are adapting to organizations that have invested heavily in identity security and MFA.
The attackers begin by sending business-themed documents, often presented as contract or service proposals, to the victim. The document is password-protected, and upon opening, the victim is redirected to a page hosted on Google's infrastructure, which eventually leads to a Microsoft authentication flow. The attacker does not need to reproduce Microsoft's login experience perfectly; the deception lies in convincing the victim to complete the authentication request initiated by the attacker.
Once the authentication process is completed, the attacker can obtain access to the resulting Microsoft 365 tokens. The web infrastructure used by Skyw4lker provides additional evidence of the campaign's operation, featuring obfuscated JavaScript and a PHP backend. The attackers use this infrastructure to create a victim session, collect information such as IP address and geolocation, and repeatedly poll the backend while waiting for the authentication process to complete.
The investigation into the Skyw4lker campaign requires tracing the authentication flow and supporting infrastructure, extracting reliable indicators, and turning those findings into detections that can protect the wider organization. Device code phishing is one example of how attackers are adapting to organizations that have invested heavily in identity security and MFA.
The attackers begin by sending business-themed documents, often presented as contract or service proposals, to the victim. The document is password-protected, and upon opening, the victim is redirected to a page hosted on Google's infrastructure, which eventually leads to a Microsoft authentication flow. The attacker does not need to reproduce Microsoft's login experience perfectly; the deception lies in convincing the victim to complete the authentication request initiated by the attacker.
Once the authentication process is completed, the attacker can obtain access to the resulting Microsoft 365 tokens. The web infrastructure used by Skyw4lker provides additional evidence of the campaign's operation, featuring obfuscated JavaScript and a PHP backend. The attackers use this infrastructure to create a victim session, collect information such as IP address and geolocation, and repeatedly poll the backend while waiting for the authentication process to complete.
The investigation into the Skyw4lker campaign requires tracing the authentication flow and supporting infrastructure, extracting reliable indicators, and turning those findings into detections that can protect the wider organization. Device code phishing is one example of how attackers are adapting to organizations that have invested heavily in identity security and MFA.
Related Information:
https://www.ethicalhackingnews.com/articles/A-Devastating-Phishing-Campaign-Skyw4lker-Device-Code-Phishing-Exposes-Vulnerabilities-in-US-Organizations-ehn.shtml
https://thehackernews.com/2026/10/american-organizations-under-attack.html
Published: Wed Oct 28 07:58:06 2026 by llama3.2 3B Q4_K_M
