SkyW4lker Phishing Campaign Expands, Threatening US Enterprises with Microsoft 365 Account Takeovers

A phishing kit called SkyW4lker (also branded SkyW4lker x365 Sentinel) is quietly taking over Microsoft 365 accounts without ever stealing a password.

Instead of cracking logins or breaking MFA, it tricks employees into approving a legitimate Microsoft device-code sign-in, handing attackers a valid session to corporate mailboxes, documents, and connected apps.

The kit has been active since June 2026 and is accelerating fast. Researchers at ANY.RUN tracked 618 sandbox analyses tied to SkyW4lker between June and October 21, 2026, with monthly submissions climbing from 20 in June to 200 in September.

Nearly half (46–47%) of those submissions came from the United States, more than twice the share of any other country.

For US enterprises running on Microsoft 365, that makes SkyW4lker one of the more pressing identity threats of the quarter.

This article breaks down how the kit works, who it targets, how it was traced back to a sibling phishing platform, and what SOC teams and security leaders can do about it.

Key takeaways

• No password theft, no MFA bypass needed. SkyW4lker abuses Microsoft’s OAuth 2.0 device-code flow. The victim types a code into a real Microsoft login page; the attacker gets the token.
• Delivery looks like routine business. Password-protected PDF, DOCX, or XLSX attachments posing as contracts, invoices, statements, and service proposals, with the password in the email body.
• Trusted platforms are part of the chain. Lure and redirect pages sit on Google Sites, Miro, Zoom, Smartsheet, Axure Cloud, Cloudflare R2, Linode object storage, and similar services, so links pass reputation checks.
• The kit is professionally built. A PHP backend, obfuscator.io-style JavaScript, IP geolocation of every visitor, CAPTCHA gating to block scanners, and an admin panel with Telegram-based MFA and live victim notifications.
• It shares DNA with Gabagool. Identical JavaScript modules, landing-URL formats, CAPTCHA widget, and hosting directories link SkyW4lker to the Gabagool credential-phishing kit active since April 2026. ANY.RUN assesses with high confidence that one developer built both.
• US tech, manufacturing, and government organizations are the main submitters, followed by India, Canada, and the UK.
• Faster correlation shortened the investigation. ANY.RUN’s Related Threat Context surfaced earlier sandbox sessions with the same URL patterns, which let analysts pivot into Threat Intelligence Lookup, expand the campaign cluster, and locate the kit’s admin panel.

What SkyW4lker is

SkyW4lker is a device-code phishing kit: it rents or sells attackers a complete pipeline for turning a phishing click into a working Microsoft 365 session. It first appeared on June 23, 2026 and has been continuously updated since, with new endpoints and changing URL tokens.

Attribute	Detail
Threat type	Phishing kit (device-code phishing)
Objective	Microsoft 365 / OAuth access tokens, plus harvested emails, passwords, and MFA status
Core techniques	Device-code abuse, obfuscated JavaScript (obfuscator.io), IP geolocation and ISP profiling, CAPTCHA gating (Cloudflare Turnstile and a self-hosted widget)
Delivery	Password-protected PDF/DOCX/XLSX/EML attachments; redirect links on Google Sites, Google Maps, Miro, Zoom, Smartsheet, Axure Cloud
Lure themes	Contracts, invoices, approved statements, Fedwire payment notices, service proposals
Hosting	Mostly DigitalOcean VPS (50 of 92 backend IPs), look-alike domains with Microsoft-themed subdomain chains, free dynamic-DNS hosts
Operator / brand	SkyW4lker (SkyW4lker x365 Sentinel)
Activity window	June 2026 – present
Related kit	Gabagool (credential phishing, active since April 2026)

Why US enterprises are in the crosshairs

The United States accounts for roughly 47% of all SkyW4lker-related sandbox submissions. The organizations submitting samples cluster in technology, manufacturing, and government, sectors where Microsoft 365 is the default collaboration layer and where a compromised mailbox can expose contracts, financial data, and supply-chain partners.

The risk is structural rather than technical. Device-code phishing succeeds against accounts that have MFA enabled, because the user genuinely completes an MFA-protected sign-in; they simply do it on the attacker’s behalf. That means four things for enterprise security:

• Identity policy gaps. If device-code authentication is allowed broadly, MFA alone will not stop this attack.
• Detection blind spots. Every step touches a legitimate service: a real document platform, a real CAPTCHA, a real Microsoft login page. Nothing in the chain looks obviously malicious to email filters or users.
• Wide blast radius. One token can unlock Outlook, OneDrive, SharePoint, Teams, and any app federated through Entra ID, and it becomes a launchpad for phishing customers and partners from a trusted address.
• Higher response costs. Separating a malicious device-code sign-in from thousands of legitimate ones, then scoping what the attacker touched, consumes Tier-1 and Tier-2 time.

Protect corporate accounts from Microsoft 365 phishing attacks with faster detection and response. Talk to ANY.RUN about enterprise protection →

How a SkyW4lker attack unfolds

The full chain, from lure document to device-code prompt, was detonated and recorded in the ANY.RUN Interactive Sandbox. You can replay it and pull indicators here: View the SkyW4lker analysis session →

1. The lure lands. The target receives an email about a commercial offer, contract, invoice, or confidential document. Attached is a password-protected PDF, DOCX, or XLSX; the password sits in the email body. The encryption defeats attachment scanning, and the password-in-body pattern feels normal to anyone who deals with vendors.
2. The redirect chain. The document contains a link, usually to a CAPTCHA page. Some variants add an intermediate decoy page on Miro, Google Sites, Zoom, or a cloud bucket before forwarding the victim. The CAPTCHA (Cloudflare Turnstile or the kit’s own widget) keeps automated URL scanners from ever seeing the payload page.
3. The device-code prompt. The victim arrives at a branded phishing page that displays a Microsoft device code and instructs them to enter it at Microsoft’s real login.microsoft.com/device page. Once they do, and complete MFA if prompted, the attacker’s backend receives an OAuth access token for the account. No password ever crosses the wire to the attacker, and the sign-in shows up in Entra ID as a legitimate device-code authentication.

Inside the kit

The phishing page is a thin front end for a PHP backend, and ANY.RUN’s In-Browser Data Inspection exposes how it works by showing the live DOM and HTTP traffic side by side.

The main script loads helper modules, wires up the page’s buttons, and talks to the backend through one endpoint, /session_public.php, with two actions:

• action=start sends the victim’s IP address, ISP, organization, and geolocation to the server and receives a session ID.
• action=poll fires every few seconds with that session ID, asking whether the victim has finished authenticating. When the answer flips to yes, the attacker has the token.

Module	What it does
client_geo.js	Fingerprints the visitor’s location via ip-api.com, ipapi.co, or ipwho.is (or a server-side client_geo.php). Used to profile targets and feed the admin dashboard.
url_helper.js	Utility wrappers for building GET parameters and normalizing URLs.
endpoint.js	Tracks the victim’s state and logs email, password, browser, MFA status, and country to php/endpoints/accounts.php.

The JavaScript is obfuscated in obfuscator.io style; 520 of the 618 analyses carry ANY.RUN’s obfuscated-js tag.

That is deliberate friction for anyone trying to reverse the page statically, which is why detonating it in an interactive sandbox and watching the requests is the faster route.

From one URL to the whole campaign

Finding one SkyW4lker page is easy. Finding the other 170-plus domains, the shared hosting, the admin panel, and the sibling kit is where most investigations stall.

Traditionally that means repeated IOC lookups, manual correlation across old cases, and a lot of copy-pasting between tools.

ANY.RUN’s Related Threat Context feature collapsed that work. Inside the sandbox session, a Related analyses panel listed earlier submissions that used the same /session_public.php URL pattern, giving analysts an instant starting cluster instead of a blank search box.

From there, a one-click pivot into Threat Intelligence Lookup on the distinctive endpoint returned additional phishing activity, expanded the campaign to its current size, and exposed infrastructure overlaps that would otherwise have taken days to assemble.

The same workflow applies to any suspicious URL or indicator a SOC receives: start from the alert, see what the community has already analyzed, and build on it rather than starting over.

The payoff shows up at both tiers. Tier-1 analysts spend less time re-researching indicators that someone else already resolved and get enough evidence to triage confidently.

Tier-2 analysts receive richer context up front and can focus on the cases that actually need deep analysis.

Give your SOC the context needed to speed up phishing investigations, reduce repetitive work, and boost Tier-1 productivity. See how the Interactive Sandbox connects threats →

The admin panel

Because each phishing page runs its own backend, the operator’s control panel usually lives on the same host.

Combining Threat Intelligence Lookup results with external data turned up a login form at /admin/index.php, and its stylesheet (command-center.css) describes what the kit offers its customers:

• Operator login with MFA delivered over Telegram
• A victim dashboard fed by client_geo.js geolocation data
• Server management and generation of new phishing links
• Real-time notifications whenever a target opens a link

SkyW4lker and Gabagool: one developer, two attack modes

Searching ANY.RUN Threat Intelligence for SkyW4lker’s module paths (/js/client_geo.js, /js/url_helper.js, /js/endpoint.js) also returns sessions tagged Gabagool, a credential-phishing kit first seen on April 23, 2026, two months before SkyW4lker.

Feature	SkyW4lker	Gabagool
First seen	June 23, 2026	April 23, 2026
Analyses in six months	618	458
Shared JS modules	client_geo.js, url_helper.js, endpoint.js (since July 2026)	Same three modules (since late April 2026)
Visit endpoint	/assets/php/endpoints/confirm_visit.php	Identical
Self-hosted CAPTCHA	/assets/private_captcha/public/widget.js?v=4	Identical
Landing token	zt[A-Za-z0-9]{32}op, then it[A-Za-z0-9]{32}us from Aug 10	Same tokens, it…us from Aug 5
Shared hosts and directories	5200m[.]com/kvme2/, torvion[.]life/ofulium/, ghethim[.]com/hyllen/	Same directories, within days of each other
Hosting	Mostly DigitalOcean	Mostly DigitalOcean; shared IP 172.86.85[.]51
Main endpoint	session_public.php (device-code flow)	accounts.php (username/password harvesting)

Some Gabagool sessions even load the kit from directories literally named skywalker and skyw4lker on goldcreekconcrete[.]com and goldcreekconcrete[.]org.

ANY.RUN’s assessment: the same developer built both kits, and they are best understood as two modes of one phishing platform, one that harvests passwords, one that harvests device-code tokens.

Whether a single operator runs both, or multiple customers bought the same product, the data cannot yet say.

How to detect SkyW4lker and reduce exposure

For SOC analysts and threat hunters

• Hunt the kit’s fingerprints. Alert on outbound requests to /session_public.php?action=start followed by repeated ?action=poll calls, and on the three module paths (client_geo.js, url_helper.js, endpoint.js) under /assets/js/. The landing token regex //it[A-Za-z0-9]{32}us (previously //zt[A-Za-z0-9]{32}op) is a reliable signature for the landing URL.
• Tie phishing to sign-ins. In Microsoft Entra ID sign-in logs, filter for device-code authentications and correlate them against recent suspicious emails or document-share notifications to the same user. A device-code sign-in minutes after a “protected invoice” email is a strong compromise signal.
• Detonate, don’t guess. Password-protected attachments and CAPTCHA-gated links defeat static scanners by design. Open them in an interactive sandbox, supply the password, pass the CAPTCHA, and watch the real traffic.
• Pivot beyond the single IOC. Use Related Threat Context and Threat Intelligence Lookup to check whether the domain, endpoint, or module path already appears in other analyses. That turns a one-off alert into campaign-level visibility in minutes.
• Scope the follow-on. When a token theft is suspected, review mailbox rules, OAuth app consents, SharePoint/OneDrive access, and outbound mail from the account to catch lateral phishing against colleagues and partners.

Give your SOC the speed to handle more threats with 20% less Tier-1 investigation time and 30% fewer escalations. Book an enterprise demo →

For CISOs and security leaders

SkyW4lker is a reminder that MFA is necessary but not sufficient. Three priorities:

1. Close the device-code gap. Audit where device-code authentication is actually needed (typically headless devices, CLI tools, and some conferencing hardware). Block or tightly scope it with Entra Conditional Access everywhere else. This single control removes the attack’s payoff.
2. Connect email, web, and identity telemetry. The kit only works because each stage is examined in isolation. Make sure the SOC can link a suspicious attachment, the phishing infrastructure it reaches, and the authentication event that follows.
3. Shorten the investigation loop. Give Tier-1 analysts historical threat context and clear escalation criteria so routine phishing cases close at Tier 1, and reserve Tier 2 for incidents that truly need deeper work. Define a containment runbook for token-based compromise: revoke sessions, reset credentials, review app consents, and check for persistence.

MITRE ATT&CK mapping

Tactic	Technique	How SkyW4lker does it
Reconnaissance	T1589.002 Email Addresses	Recipient address appended to the landing URL to personalize the page
Reconnaissance	T1590.005 IP Addresses	client_geo.js records IP, ISP, organization, and location at action=start
Resource Development	T1583.001 Domains	Typo-squatted company domains with Microsoft-themed subdomain chains; free dynamic-DNS hosts
Resource Development	T1583.003 VPS	DigitalOcean for 50 of 92 backend IPs
Resource Development	T1608.005 Link Target	Intermediate pages on Cloudflare R2, Linode object storage, Mintlify
Initial Access	T1566.001 Spearphishing Attachment	Password-protected PDF/XLS/DOCX/EML named *-protected.pdf or DOC <random>.pdf
Initial Access	T1566.002 Spearphishing Link	Google Sites, Axure Cloud, Smartsheet pages; maps.google[.]ie/url?q= redirects
Execution	T1204.001 Malicious Link	Victim opens //it[A-Za-z0-9]{32}us landing path
Defense Evasion	T1656 Impersonation	Subjects like “Approved Statement” and “Fedwire Funds Service Processed”
Defense Evasion	T1497 Sandbox Evasion	Cloudflare Turnstile and self-hosted CAPTCHA in front of the payload page
Defense Evasion	T1027 Obfuscation	obfuscator.io-style JavaScript (520 of 618 analyses)
Credential Access	T1528 Steal Application Access Token	Abuses login.microsoftonline[.]com/common/oauth2/deviceauth while polling action=poll
Collection	T1056.003 Web Portal Capture	endpoint.js logs email, password, browser, MFA status, and country

Indicators of compromise

All indicators were observed in ANY.RUN analyses between June 23 and October 21, 2026. The full list of 173 phishing domains, plus live sandbox sessions, is available in the original ANY.RUN research.

URL patterns

Pattern	Purpose	Seen
//it[A-Za-z0-9]{32}us	Current landing token (may end ? or ??)	Aug 10 – Oct 19, 2026
//zt[A-Za-z0-9]{32}op	Earlier landing token	Jun 25 – Sep 28, 2026
/assets/php/endpoints/session_public.php?action=start&ip=…	Session registration with geolocation	Jun 23 – Oct 21, 2026
/assets/php/endpoints/session_public.php?action=poll&session_id=	Device-code status polling	Jun 23 – Oct 21, 2026
/assets/js/client_geo.js	Geolocation module	Jul 7 – Oct 19, 2026
/assets/js/endpoint.js	Session state and credential logging	Jul 22 – Oct 20, 2026
/assets/js/url_helper.js	URL helper module	Jul – Oct 2026
/assets/php/endpoints/confirm_visit.php	Visit confirmation	Aug 31 – Oct 15, 2026
/assets/private_captcha/public/widget.js?v=4	Self-hosted CAPTCHA gate	Jul 7 – Sep 28, 2026
/assets/php/attach/js/mstoken_document_(adobe|onedrive|excel)_[A-Za-z0-9]{50}.js	Brand-specific document script	Jul 20 – Oct 20, 2026
(docshare|sdocshares|pdocshared|efaxdoc|reauth|statement|copilot|login|auth).*(outlook|onedrive|copilot|office365).*	Microsoft-themed hostname chain on look-alike domains	Jun – Oct 2026

Sample domains and infrastructure

• 5200m[.]com, torvion[.]life, ghethim[.]com (hosts shared with Gabagool)
• goldcreekconcrete[.]com, goldcreekconcrete[.]org (/skywalker/, /skyw4lker/ directories)
• sdocshares.auth.outlook2026common.copilos26.csr-rooflng[.]com
• pdocshared.payments2026.outlooks.common.ecmholdlnggroup[.]com
• flow505.mooo[.]com, bigbrain.chickenkiller[.]com, off365acess.jumpingcrab[.]com
• 172.86.85[.]51 (priorispace[.]biz), 162.243.64[.]121, 67.205.154[.]32
• Sample lure SHA256: 9aa0b87974b9b4cd42603833b7ad44257578467d279b315a071108a5ed02c268

Conclusion

SkyW4lker is not a novel exploit; it is a well-engineered abuse of a feature Microsoft 365 ships by default.

Its growth from 20 to 200 sandbox submissions a month in a single quarter, its concentration on US enterprises, and its shared lineage with Gabagool all point to a phishing platform that will keep shipping new modes as long as device-code sign-ins stay open and SOCs keep treating phishing alerts one at a time.

The defensive answer is equally unglamorous: restrict device-code authentication where it is not needed, correlate email and identity events, and give analysts the ability to detonate what filters cannot inspect and to see, in one view, what the rest of the community has already found about the same infrastructure.

Protect corporate accounts from Microsoft 365 phishing attacks with faster detection and response. Contact ANY.RUN sales →

About ANY.RUN

ANY.RUN helps SOC and MSSP teams detect and investigate threats faster. Its Interactive Sandbox lets analysts open suspicious files and URLs, supply passwords, pass CAPTCHAs, and watch full attack chains unfold, while Threat Intelligence Lookup, Feeds, and Reports connect each case to activity seen across more than 16,000 organizations and 700,000 security professionals. ANY.RUN is SOC 2 Type II certified.

Research credit: ShiFu, Threat Intelligence Analyst, ANY.RUN. Original report published October 27, 2026.