American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed
Summary: ANY.RUN's analysis of the Skyw4lker device code phishing campaign describes attacks on U.S. manufacturing, technology, and healthcare organizations using password-protected documents presented as contracts or service proposals, which lead victims to a page on sites[.]google[.]com and into a legitimate Microsoft authentication flow. The attacker initiates the device authorization request and obtains Microsoft 365 tokens once the victim completes it, with obfuscated JavaScript and a PHP backend creating a victim session, collecting IP address and geolocation, and polling until authentication finishes.
What's compelling: The authentication event is valid, so identity telemetry alone may show a successful login without the malicious context behind it, and a compromised Microsoft 365 account can expose sensitive communications, intellectual property, operational information, and regulated data in the targeted sectors.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026