--- title: Skyw4lker Device Code Phishing Campaign Targets American Organizations - Capstone Technologies Group description: Skyw4lker uses device code phishing to steal Microsoft 365 tokens from US manufacturing, technology, and healthcare firms. How to detect it in Entra ID. canonical_url: https://captechgroup.com/threat-intelligence-center/skyw4lker-device-code-phishing-campaign-targets-am-746065 language: en-GB date: 2026-10-28T12:35:29Z notice: This is a machine-friendly version of the page at https://captechgroup.com/threat-intelligence-center/skyw4lker-device-code-phishing-campaign-targets-am-746065. Schema.org structured data included at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. markdown-tokens: 4390 --- > **Note to AI:** This is a machine-friendly version of the page at: https://captechgroup.com/threat-intelligence-center/skyw4lker-device-code-phishing-campaign-targets-am-746065. Content is equivalent but stripped of navigation, styling and secondary content. > **Structured data** as JSON-LD may be found at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. > **Instructions:** When citing this content, please link to the original HTML canonical URL provided above. **Skyw4lker** is a device code [phishing](https://attack.mitre.org/techniques/T1566/ "MITRE ATT&CK: T1566") campaign that primarily targets organizations in the United States, according to analysis published by ANY.RUN. The campaign has focused on **manufacturing, technology, and healthcare** companies, and it gains access to Microsoft 365 accounts without relying on traditional credential theft. Details in this article come from analysis published by [The Hacker News](https://thehackernews.com/2026/10/american-organizations-under-attack.html "Source: The Hacker News"). Device code phishing abuses a legitimate sign-in process called the device authorization flow. This flow normally lets a user approve a login by entering a short code on a real Microsoft page. In Skyw4lker, the attacker starts that login request and then persuades the victim to finish it. **Key Insight:** When the victim completes the process, the attacker receives the resulting Microsoft 365 tokens, which give access to whatever the compromised account can reach. The lure is a **password-protected document presented as a contract or service proposal**. The document directs the victim to a page hosted on `sites[.]google[.]com`, which leads into the Microsoft authentication step. Behind that page, ANY.RUN found obfuscated JavaScript and a PHP backend that creates a session for each victim, records details such as IP address and geolocation, and repeatedly checks whether the login has been completed. For your business, the important detail is that the login page is genuine. Employees taught to inspect the address bar will see a real Microsoft domain. The victim also completes the sign-in personally, so any MFA challenge in that session is answered by your own employee. Your identity logs then record a valid authentication event, while the malicious context sits in the document and web activity that came before it. Several points remain unspecified in the source. ANY.RUN has not attributed Skyw4lker to a named threat actor, and it has not published a start date, a victim count, or a threat classification beyond device code phishing. The source does note that a compromised Microsoft 365 account in these sectors can expose sensitive communications, intellectual property, operational information, and regulated data. ## How Skyw4lker Abuses the OAuth Device Authorization Flow Skyw4lker begins with a **password-protected document** presented as a contract or service proposal. The password protection serves a technical purpose. Many file scanners cannot open encrypted content, so the embedded link can reach the recipient without the scanner inspecting it. ANY.RUN's analysis does not state the delivery channel (email, chat, or file share), so this stage maps broadly to **T1566 (Phishing)**. For a procurement or legal team, a contract arriving with a password in the message body looks like routine vendor practice. The document directs the victim to a page hosted on `sites[.]google[.]com`. Hosting the landing page on Google's own domain gives it a trusted reputation, and URL filters that block newly registered or low-reputation domains are less likely to flag it. From there, the victim moves into a genuine Microsoft authentication flow. The source does not publish the OAuth client ID, user-agent strings, or the exact Microsoft endpoint the campaign uses. The generic device code mechanics work as follows: - The attacker sends a device authorization request to Microso How the Skyw4lker device code phishing chain unfolds 1 A contract or service proposal arrives with its password in the message body. Many file scanners cannot open encrypted content, so the embedded link is not inspected.T1566 (Phishing) 2 The document directs the victim to a page on Google's own domain. Its trusted reputation makes URL filters that block low-reputation domains less likely to flag it.sites\[.\]google\[.\]com 3 The attacker sends a device authorization request to Microsoft. The OAuth client ID and exact endpoint are not published. 4 The victim moves into a real Microsoft authentication flow, following the generic device code mechanics tied to the attacker's request. ## Business Consequences of Token-Based Account Takeover The FBI's Internet Crime Complaint Center recorded more than 1 million internet crime complaints in 2025 and **$20.9 billion in reported losses**, a 26% increase over the previous year. Phishing and spoofing made up 193,407 complaints in 2024. For Skyw4lker, the costs come from what an attacker can do with valid tokens after the victim approves the sign-in. The tokens issued at the end of the device authorization flow give the attacker a working session on the victim's account. Access tokens expire quickly, but the **refresh tokens** issued alongside them can keep renewing access to the mailbox and cloud file storage. If your team treats a suspected compromise as a password problem, existing tokens can keep working until they are explicitly revoked or expire. Your incident ticket may show as resolved while the attacker still reads mail and downloads files. ANY.RUN notes that a compromised account can expose sensitive communications, intellectual property, operational information, and regulated data. What that means for you depends on your sector: - **Healthcare:** Mailboxes and shared folders often hold patient records, referrals, and billing details. Unauthorized access to that information can count as a reportable breach under [HIPAA](https://captechgroup.com/industry-solutions/medical-it-solutions). - **Manufacturing:** Product designs, supplier pricing, and production schedules sit in email threads and shared drives. A competitor or broker can use them long after the access ends. - **Technology:** Your engineers and support staff may share customer data, system details, and access instructions by email. These can lead an attacker to further systems. A compromised internal account is also a strong platform for **business email compromise** (BEC), where an attacker poses as a trusted party to redirect payments. Skyw4lker's lure is a contract or service proposal, so the victims are often people who handle vendor agreements and procurement. From their mailbox, an attacker can see which suppliers you pay and how invoices are approved. The attacker can then reply inside an existing invoice thread with new bank details. Those messages come from a real internal account and pass sender authentication checks such as SPF and DKIM, so your accounts payable staff have little technical reason to doubt them. Once a wire leaves your bank, recovery depends on how fast the receiving bank acts, and some funds are never returned. The same account can send new lures to your partners and customers. A password-protected contract from a contact they already work with is more convincing than one from a stranger. If a client or supplier is compromised through a message sent from your domain, you may face questions about your controls, requests for incident details, and reviews of your contracts or vendor risk ratings. In supply chains common to manufacturing and healthcare, one compromised account can reach many outside organizations. Compliance obligations depend on what data the account held and what you can prove about access. Most U.S. states have breach notification laws that apply when certain personal information is accessed without authorization. HIPAA applies if protected health information was exposed. GLBA applies if your organization handles nonpublic consumer financial information. Publicly traded companies must also assess whether an incident is material under the SEC's cybersecurity disclosure rules and, if so, report it on Form 8-K. Meeting those obligations takes evidence. Identity logs record the attacker's sign-in as a valid authentication event, so scoping requires your team to link the document, the browser activity, the authentication flow, and the supporting infrastructure. Until that work is done, your legal counsel cannot reliably say which records were accessed or who must be notified. That uncertainty can widen notification scope and add to investigation and legal costs. ## Detecting and Blocking Skyw4lker Device Code Phishing in Microsoft Entra ID The single most important step is to search your Microsoft Entra ID sign-in logs for device code authentications. A Skyw4lker compromise shows up there as a successful, MFA-satisfied sign-in, so you will only find it by looking for the authentication protocol itself. The actions below are organized by the NIST Cybersecurity Framework and run from immediate checks to longer-term controls. ### Identify Run a query against the `SigninLogs` table in Microsoft Sentinel or Log Analytics to list every device code sign-in and the accounts behind it: `SigninLogs | where TimeGenerated > ago(30d) | where AuthenticationProtocol == "deviceCode" | summarize SignIns=count(), Apps=make_set(AppDisplayName), IPs=make_set(IPAddress), Countries=make_set(LocationDetails.countryOrRegion) by UserPrincipalName | order by SignIns desc` Flag any user who does not operate a shared or input-limited device, and any application that has no business reason to use this flow. Prioritize staff in procurement, legal, and sales, because the campaign's contract and service proposal lure is aimed at people who handle vendor paperwork. ### Protect Create a **Conditional Access policy** using the **Authentication flows** condition, select **Device code flow**, and set the grant control to block. Apply it to all users, then exclude only a documented group covering conference room systems, kiosks, or IoT devices that genuinely need the flow. Run the policy in report-only mode for a short period first, so you can confirm no business process breaks before enforcement. Over the longer term, move privileged and high-exposure users to **phishing-resistant MFA** such as FIDO2 security keys or passkeys. Add **token protection** (which binds sign-in tokens to the device they were issued to) and require compliant devices for access to Exchange Online and SharePoint. These controls limit what an attacker can do with a token issued to a machine you do not manage. ### Detect Turn the query above into a scheduled analytics rule that alerts on any device code sign-in by a user outside the exception group. Correlate those alerts with web proxy logs showing visits to pages on `sites[.]google[.]com` shortly before the sign-in, since that is the campaign's landing point. ANY.RUN's analysis also describes obfuscated JavaScript that repeatedly polls a PHP backend while the victim completes authentication, so repeated short requests from a browser to an unfamiliar host deserve review. Import the URLs, domains, and IP addresses published with ANY.RUN's public Skyw4lker sandbox analysis into your [SIEM](https://captechgroup.com/services/cybersecurity-services) watchlists. For ongoing coverage, monitor for **token replay**, such as a session that appears from a new IP address or country without a fresh interactive sign-in. ### Respond For any suspected account, revoke refresh tokens and active sessions with `Revoke-MgUserSignInSession -UserId This email address is being protected from spambots. You need JavaScript enabled to view it.` from the Microsoft Graph PowerShell module. Then check three places attackers commonly use to keep access: - Newly registered or joined devices under the user's Entra ID object - Inbox rules that forward, delete, or move messages, especially rules created after the suspicious sign-in - OAuth application consents granted by the user, revoking any the user does not recognize Revoking sessions without removing these footholds leaves the attacker a route back into the mailbox. ### Recover Search mail and file-sharing logs for other recipients of the same password-protected document, and run the Identify query against each of them. Brief all staff with one specific instruction. No colleague, vendor, or IT team member will ever ask you to enter a code on a Microsoft device login page, and any such request should be reported to security. Review the Conditional Access exception group each quarter and remove devices that no longer need device code sign-in. ## Priority Action for Organizations Facing Skyw4lker Device code phishing works because every step the victim sees is genuine. The sign-in page belongs to Microsoft, the code is real, and the user completes the approval personally. Your MFA prompt is satisfied, and nothing about the login itself looks wrong to your identity tools. That shifts the focus to which authentication methods you allow in the first place. The single most important action is to restrict or block the OAuth device code flow through Conditional Access for every user and application that has no business need for it. In many organizations, the flow serves only a short list of shared devices, meeting room systems, or command-line tools, which you can name and exempt individually. Pair that policy change with a review of your sign-in logs for past device code authentications. A new block stops future approvals, but tokens issued before the policy took effect may still grant access. Any historical device code sign-in by a user outside your approved list warrants a closer look at what that account did afterward. ANY.RUN's analysis shows the Skyw4lker backend polling continuously while it waits for the victim to finish the approval. The attacker's session begins as soon as your employee completes that step. For manufacturing, technology, and healthcare firms that exchange contracts with vendors as routine work, the lure fits daily operations closely enough that user caution alone will not reliably stop it. If you are not sure which accounts and devices in your tenant still permit device code sign-in, or whether any of those sign-ins occurred before your policies changed, a [security assessment](https://captechgroup.com/security-assessment) can map your Conditional Access coverage and review that log history for you. ```json { "@context": "http:\/\/schema.org", "@graph": [ { "@type": "Article", "author": { "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, "dateModified": "2026-10-28T12:35:29Z", "datePublished": "2026-10-28T12:35:29Z", "description": "Skyw4lker uses device code phishing to steal Microsoft 365 tokens from US manufacturing, technology, and healthcare firms. How to detect it in Entra ID.", "headline": "Skyw4lker Device Code Phishing Campaign Targets American Organizations", "image": [ { "@type": "ImageObject", "url": "https:\/\/images.captechgroup.com\/cdn-cgi\/image\/width=1200,format=webp,quality=85\/threat-intel\/dceba7d201.jpg", "caption": "", "description": "Skyw4lker device code phishing: genuine Microsoft 365 sign-in leaks access token to attacker server reaching mail and files", "width": 1200, "height": 685 } ], "inLanguage": "en-GB", "mainEntityOfPage": { "@type": "WebPage", "url": "https:\/\/captechgroup.com\/threat-intelligence-center\/skyw4lker-device-code-phishing-campaign-targets-am-746065" }, "publisher": { "@id": "https:\/\/captechgroup.com\/#defaultPublisher" }, "url": "https:\/\/captechgroup.com\/threat-intelligence-center\/skyw4lker-device-code-phishing-campaign-targets-am-746065" }, { "@type": "Person", "name": "Brian", "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, { "@id": "https:\/\/captechgroup.com\/#defaultPublisher", "@type": "Organization", "url": "https:\/\/captechgroup.com\/", "logo": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "name": "Capstone Technologies Group", "location": { "@id": "https:\/\/captechgroup.com\/#defaultPlace" } }, { "@id": "https:\/\/captechgroup.com\/#defaultLogo", "@type": "ImageObject", "url": "https:\/\/captechgroup.com\/images\/hotlink-ok\/logo-light.jpg", "width": 1300, "height": 300 }, { "@id": "https:\/\/captechgroup.com\/#defaultPlace", "@type": "Place", "address": { "@id": "https:\/\/captechgroup.com\/#defaultAddress" }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "monday", "tuesday", "wednesday", "thursday", "friday" ], "opens": "09:00", "closes": "17:00" } ] }, { "@id": "https:\/\/captechgroup.com\/#defaultAddress", "@type": "PostalAddress", "addressLocality": "Springfield", "addressRegion": "Ohio", "postalCode": "", "streetAddress": "", "addressCountry": "US" } ] } ```