A sophisticated new phishing kit named SkyW4lker (also called SkyW4lker x365 Sentinel) has been quietly compromising Microsoft 365 accounts in US organizations without stealing passwords or bypassing MFA in the usual way. Instead, this tool abuses Microsoft’s OAuth 2.0 device-code flow: victims are tricked into entering a device code on the real Microsoft login site. Once that code is entered—and after completing MFA if prompted—the attacker gains full account access via a valid session token.
How the Attack Works and Grows
SkyW4lker has been active since June 2026 and has rapidly ramped up—sandbox submissions rose from about 20 in June to 200 in September, with a total of 618 analyses recorded by October 21. Nearly half of all observed attacks—roughly 46-47%—originate from the US, making it a mounting threat for American enterprises. Tech, manufacturing, and government sectors are especially targeted, due to their heavy reliance on Microsoft 365 for collaboration and sensitive data sharing.
The phishing chain begins with an email containing a password-protected PDF, DOCX, or XLSX file—attachments that appear innocuous because the password is included in the email body. These files serve to evade static attachment scanners. Upon opening the document, the victim is redirected—often via trusted platforms like Google Sites, Miro, Zoom, Smartsheet, Axure Cloud, or cloud storage services—to a CAPTCHA gate followed by a prompt to enter a Microsoft device code. By placing the code on Microsoft’s own .live login page, SkyW4lker captures the session token after the user completes all required steps, including MFA.
An Engineered Tool with Links to Gabagool
SkyW4lker’s infrastructure is professionally built. It includes a PHP backend, obfuscator.io-style JavaScript modules, IP geolocation, CAPTCHA gating, and an admin panel that sends notifications via Telegram. Analysis shows strong overlap with another phishing kit called Gabagool. The two share key JavaScript components, URL token patterns, hosting IPs (many on DigitalOcean), and file structures. While Gabagool focuses on credential harvesting, SkyW4lker captures device-code tokens. Researchers believe both kits stem from the same developer or development team.
Why MFA Isn’t Enough and How to Detect the Threat
Because SkyW4lker coaxes victims into completing legitimate MFA flows during device-code authentication, the presence of MFA alone does not block the attack. Detection is complicated further by the use of real services throughout the phishing chain—CAPTCHAs, trusted web platforms, Microsoft login pages—making it difficult for email filters or users to recognize anything malicious.
Security operations teams (SOCs) are advised to hunt for key fingerprints: calls to endpoints like /session_public.php?action=start followed by repeated ?action=poll requests, and the usage of certain JavaScript modules (client_geo.js, url_helper.js, endpoint.js). Analysts should link email or document alerts with device-code sign-in events in Microsoft Entra ID logs. Attachment-based lures or protected files that redirect to unfamiliar domains should be detonated in sandboxes for inspection. A broader investigation should include mailbox rules, federated app consents, and any outbound email activity from the compromised account.
Leadership Advice & Defensive Strategies
Organizational leaders must address device-code authentication as a security gap. It should be restricted to only necessary use cases—in many cases, headless devices, command-line tools, or conferencing hardware—and blocked or tightly controlled via Conditional Access policies where possible. Telemetry from email systems, identity management, and web traffic should be merged so threat sequences—from the lure email to authentication—are visible in one chain. Accelerating response times and giving Tier-1 analysts access to threat intelligence and escalation playbooks helps resolve incidents faster and more accurately.
Mitre ATT&CK mapping places SkyW4lker across a wide array of techniques—credential access, defense evasion, reconnaissance, phishing, resource development—highlighting the multi-stage, well-engineered nature of this threat. A list of over 170 domains, including look-alike domains mimicking Microsoft, plus specific URL patterns and infrastructure indicators, has been compiled for defenders to use in hunting and blocking activity.
The rise of SkyW4lker underscores how phishing is evolving: successful attacks no longer depend solely on cracking passwords or bypassing MFA, but abuse the authentication flows built into trusted platforms. For US enterprises reliant on Microsoft 365, this threat shows that identity controls, visibility, and response playbooks matter more now than ever. What to watch: how tightly device-code flows can be controlled, whether browser or email platforms improve detection of chained phishing infrastructure, and how attack tools like SkyW4lker evolve in sophistication.
