Skyw4lker Uses Device Code Phishing to Target US Organisations

A Skyw4lker device-code phishing campaign, exposed by ANY[.]RUN, targeted American organisations and leveraged legitimate cloud services to compromise Microsoft 365 accounts without harvesting credentials via a traditional login page. The operation begins with a password‑protected document – framed as a contract or service proposal – that directs victims to a page hosted on sites.google[.]com and eventually into a Microsoft authentication flow.

Victims’ authentication tokens are obtained after participants complete a legitimate‑looking, but attacker‑initiated, device authorization sequence. The campaign has focused on sectors including manufacturing, technology and healthcare.

ANY[.]RUN’s sandbox analysis provides concrete evidence of the campaign’s infrastructure and workflow. Researchers observed obfuscated JavaScript and a PHP backend used to create victim sessions, capture IP and geolocation, and poll the backend while waiting for authentication to complete. Skyw4lker’s activity is not fully visible through identity telemetry alone, since a valid authentication event may occur within legitimate context.

The analysis also notes that the original document’s static form only partly reveals the process; a chain of browser activity, redirects, network traffic, and the associated backend infrastructure must be correlated to understand the attack and identify reliable indicators of compromise. Any[.]RUN’s threat‑intel feeds claim that up to 30% of unique malicious IOCs discovered in sandbox sessions were already present in TI Feeds, while additional context is available via TI Lookups and TI Reports.

The report emphasises tracing the document, web activity, authentication flow and infrastructure to validate alerts and develop detections. The FBI’s 2024 and 2025 phishing statistics are cited to illustrate the broader threat landscape.