Threat reportPhishingTL-2026-4593
SkyW4lker: Device-Code Phishing Kit Targeting Microsoft 365 Accounts of American Enterprises
SkyW4lker: Device-Code Phishing Kit Targeting Microsoft 365 (TL-2026-4593), also tracked as SkyW4lker x365 Sentinel, is a high-severity phishing campaign, first published 2026-10-28. It has no confirmed attribution, affects Microsoft Microsoft 365 / Microsoft Entra ID (OAuth 2.0 device, maps to 13 MITRE ATT&CK techniques (T1027, T1056.003, T1204.001), and is covered by 9 detection rules and 26 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 13MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 26Indicators of compromise
Key facts for TL-2026-4593
- Threat ID
- TL-2026-4593
- Also known as
- SkyW4lker x365 Sentinel, SkyW4lker
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, manufacturing, government administration
- Target regions
- North America, united states of america, india, canada, united kingdom
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in SkyW4lker: Device-Code Phishing Kit Targeting Microsoft 365
Malware and tooling: Gabagool, SkyW4lker
How SkyW4lker: Device-Code Phishing Kit Targeting Microsoft 365 works
SkyW4lker (also SkyW4lker x365 Sentinel) is an active phishing kit that abuses Microsoft's legitimate OAuth 2.0 device-code authentication to obtain Microsoft 365 access tokens without stealing passwords or defeating MFA. ANY.RUN observed 618 sandbox analyses between June 23 and October 21, 2026, about 47% from the United States, and assesses with high confidence that the kit was built by the same developer as the Gabagool phishing kit.
SkyW4lker is a PHP-based phishing kit with an obfuscated JavaScript front end (obfuscator.io) that targets Microsoft 365 accounts through the OAuth 2.0 device-code flow. Instead of cloning a Microsoft login page and harvesting passwords, the kit gets the victim to enter an attacker-generated device code at the legitimate Microsoft device-login page (login.microsoft.com/device). The victim completes real authentication and MFA, and the attacker's backend, which polls /assets/php/endpoints/session_public.php?action=poll, receives the resulting access tokens. Because the victim authenticates on genuine Microsoft infrastructure, the activity is harder to distinguish from normal business sign-ins.
Delivery is a three-stage chain. Emails carry password-protected attachments (PDF, DOCX, XLSX) containing links to phishing pages. Business-workflow lures are used: contracts, invoices and service proposals, with subjects such as 'New Submission From', 'Approved Statement' and 'Fedwire Funds Service'. Victims then meet a CAPTCHA (a self-hosted widget at /assets/private_captcha/public/widget.js?v=4) and optional decoy pages hosted on legitimate services (Google Sites, Miro, Zoom), and finally a page that asks for a Microsoft device code. Landing URLs follow token patterns of the form //it[A-Za-z0-9]{32}us (2026-08-10 to 2026-10-19) and the earlier //zt[A-Za-z0-9]{32}op (2026-06-25 to 2026-09-28).
The kit's JavaScript modules include client_geo.js (victim geolocation via ip-api.com, ipapi.co or ipwho.is), endpoint.js (logs email, password, browser, MFA status and country) and url_helper.js. An administration panel exists at /admin/index.php with a dashboard, server management and link generation. Backend infrastructure is hosted primarily on DigitalOcean (50 of 92 identified backend IPs), and ANY.RUN lists 173 hosting domains, including typo-squatted Microsoft-themed hostnames.
ANY.RUN assesses with high confidence that SkyW4lker and Gabagool share a developer. The evidence is shared JavaScript modules (client_geo.js, url_helper.js, endpoint.js), an identical CAPTCHA implementation, shared landing-token patterns, shared hosting directories on 5200m.com, torvion.life and ghethim.com, and a shared IP (172.86.85.51, priorispace.biz). Gabagool was first observed on 2026-04-23 and SkyW4lker on 2026-06-23. The main functional difference is that Gabagool harvests credentials via accounts.php, while SkyW4lker uses the device-code flow via session_public.php. Sandbox submissions grew from about 20 in June to about 200 in September. Top affected sectors are technology, manufacturing and government, and the top submitting countries are the US, India, Canada and the UK. Severity is analyst-assigned; there is no CVE and the information comes from a single vendor source.
MITRE ATT&CK techniques used in TL-2026-4593
Defense Evasion
T1027 Obfuscated Files or Information; T1497 Virtualization/Sandbox Evasion; T1684.001 Impersonation
Credential Access
T1056.003 Web Portal Capture; T1528 Steal Application Access Token
Execution
Initial Access
T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Resource Development
T1583.001 Domains; T1583.003 Virtual Private Server; T1608.005 Link Target
Reconnaissance
Affected products and versions in SkyW4lker: Device-Code Phishing Kit Targeting Microsoft 365
- Microsoft — Microsoft 365 / Microsoft Entra ID (OAuth 2.0 device authorization grant)
Vulnerable versions: Tenants permitting device code flow
Remediation for SkyW4lker: Device-Code Phishing Kit Targeting Microsoft 365
Immediate actions
- Block the listed SkyW4lker domains and IPs at email, DNS and web proxy layers
- Hunt web/proxy logs for /assets/php/endpoints/session_public.php?action=start and repeated action=poll requests
- Correlate phishing emails with Microsoft Entra ID sign-ins using the device code flow and revoke refresh tokens/sessions for affected users
- Review post-compromise Microsoft 365 activity (mailbox access, document access) for accounts that entered a device code
Workarounds
- Review where device-code authentication is genuinely required and restrict or block it elsewhere with Microsoft Entra Conditional Access (authentication flows condition)
- Treat password-protected email attachments containing links as high risk
Longer-term hardening
- Strengthen email-to-identity telemetry correlation so phishing delivery and Entra sign-in events can be linked
- Establish procedures for rapid account containment and lower Tier 1 escalation thresholds for suspected device-code phishing
- Train users that they should never enter a code on a Microsoft device-login page unless they started the sign-in on a device they control
- Enforce phishing-resistant MFA methods such as FIDO2 tokens
Timeline of SkyW4lker: Device-Code Phishing Kit Targeting Microsoft 365
- Microsoft Threat Intelligence publishes Storm-2372 research on device-code phishing, the same abuse technique SkyW4lker later uses; Microsoft recommends blocking device code flow via Conditional Access.
- Related Gabagool phishing kit first observed in ANY.RUN sandbox submissions (458 analyses over the observation window).
- SkyW4lker first observed; session_public.php action=start/poll endpoints seen from this date.
- Earlier landing-URL token pattern //zt[A-Za-z0-9]{32}op first seen (used through 2026-09-28).
- client_geo.js geolocation module and self-hosted private CAPTCHA widget first observed.
- New landing-URL token pattern //it[A-Za-z0-9]{32}us first seen (used through 2026-10-19).
- Throughout September (date is month-end placeholder), activity grows from roughly 20 sandbox analyses in June to roughly 200 in September.
- Latest SkyW4lker activity in the ANY.RUN dataset: 618 analyses since 2026-06-23, about 47% from the United States.
- ANY.RUN publishes its SkyW4lker analysis, linking it to Gabagool with high confidence.
Sources cited for SkyW4lker: Device-Code Phishing Kit Targeting Microsoft 365
- SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises
- Storm-2372 conducts device code phishing campaign (Microsoft Threat Intelligence)
- Device code phishing campaign (ReversingLabs)
- AiTM Phishing: Hold the Gabagool - Analyzing the Gabagool Phishing Kit
- New phishing kits target Microsoft 365 accounts, evade MFA (BleepingComputer)
- MITRE ATT&CK T1528 Steal Application Access Token
Detection coverage for TL-2026-4593
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4593 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4593
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.