Skyw4lker Exposed: How a 2026 Device Code Phishing Campaign Hijacked Microsoft 365 Accounts Across U.S. Industries
In October 2026, the Skyw4lker device code phishing campaign was identified targeting U.S. organizations across manufacturing, technology, and healthcare sectors. Attackers distributed password-protected business documents posing as contracts or service proposals, redirecting victims through Google Sites infrastructure into a legitimate Microsoft authentication flow. Rather than harvesting credentials via fake login pages, the campaign abused OAuth 2.0 device authorization grants to capture valid Microsoft 365 tokens. A PHP/JavaScript backend tracked victim sessions, collected geolocation data, and polled authentication status in real time, yielding persistent account access while generating only legitimate-looking authentication telemetry. Device code phishing represents a maturing evasion technique that bypasses MFA and traditional credential-theft defenses by exploiting legitimate cloud authentication protocols. As FBI IC3 data records over $20.9 billion in internet crime losses in 2025 and phishing volumes continue to rise, identity-based attacks that produce no fake login pages are increasingly difficult to detect with conventional email and endpoint security tools alone.
Kill Chain
