A phishing kit dubbed SkyW4lker is targeting Microsoft 365 users, particularly in the United States, by turning a legitimate authentication feature into a passwordless account-compromise mechanism, researchers at ANY.RUN reported. The campaign has been observed pursuing organizations in manufacturing, technology and healthcare, using business-themed lures rather than conventional fake login pages.
The operation begins with an email containing a password-protected PDF, DOCX or XLSX attachment presented as a contract, invoice, service proposal or other business document. The password appears in the message itself, a tactic that can help the attachment evade automated scanning. Links in the document send recipients through CAPTCHA or decoy pages, including pages hosted on legitimate services such as Google Sites, before directing them to the next stage of the attack. ANY.RUN’s analysis found the campaign using obfuscated JavaScript and a PHP backend to create sessions, collect visitor information and monitor the authorization process.
The final lure abuses Microsoft’s OAuth 2.0 device-code flow. Rather than asking a victim to type a password into a counterfeit form, the attacker generates a code and persuades the victim to enter it on a genuine Microsoft authentication page. If the victim completes the request, Microsoft issues tokens associated with the attacker-controlled authorization session, potentially giving access to the user’s email, documents and other resources permitted to the account. The technique can also defeat a user’s expectation that multifactor authentication alone will block phishing, because the victim is approving a real sign-in request.
SkyW4lker is an identity attack, not a software vulnerability, and no CVE, vendor patch or public exploit is associated with the campaign. Its significance is the abuse of a trusted cloud workflow: normal Microsoft sign-in infrastructure can appear in the browser while the attacker waits for the resulting token. ANY.RUN’s report does not attribute the activity to a named threat actor, and the available evidence does not establish a connection to a specific criminal or state-sponsored group.
Microsoft classifies device-code authentication as a high-risk flow that can be used in phishing and recommends blocking it wherever possible. Organizations should review Entra sign-in logs for unexpected device-code activity, enable a Conditional Access policy that blocks device-code flow, and create narrowly scoped exceptions only for approved devices that genuinely require it. Microsoft also says Security Defaults block device-code authentication; security teams investigating a suspected approval should revoke the user’s refresh tokens, force reauthentication and inspect recently issued sessions, consent grants and mailbox activity.
