# SkyW4lker: Device-Code Phishing Kit Targeting Microsoft 365 Accounts of American Enterprises

> SkyW4lker (also SkyW4lker x365 Sentinel) is an active phishing kit that abuses Microsoft's legitimate OAuth 2.0 device-code authentication to obtain Microsoft 365 access tokens without stealing passwords or defeating MFA. ANY.RUN observed 618 sandbox analyses between June 23 and October 21, 2026, about 47% from the United States, and assesses with high confidence that the kit was built by the same developer as the Gabagool phishing kit.

- **Published:** 2026-10-28T03:48:23Z
- **Last reviewed:** 2026-10-28T03:48:23Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4593
- **ID:** TL-2026-4593
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SkyW4lker is a PHP-based phishing kit with an obfuscated JavaScript front end (obfuscator.io) that targets Microsoft 365 accounts through the OAuth 2.0 device-code flow. Instead of cloning a Microsoft login page and harvesting passwords, the kit gets the victim to enter an attacker-generated device code at the legitimate Microsoft device-login page (login.microsoft.com/device). The victim completes real authentication and MFA, and the attacker's backend, which polls /assets/php/endpoints/session_public.php?action=poll, receives the resulting access tokens. Because the victim authenticates on genuine Microsoft infrastructure, the activity is harder to distinguish from normal business sign-ins.

Delivery is a three-stage chain. Emails carry password-protected attachments (PDF, DOCX, XLSX) containing links to phishing pages. Business-workflow lures are used: contracts, invoices and service proposals, with subjects such as 'New Submission From', 'Approved Statement' and 'Fedwire Funds Service'. Victims then meet a CAPTCHA (a self-hosted widget at /assets/private_captcha/public/widget.js?v=4) and optional decoy pages hosted on legitimate services (Google Sites, Miro, Zoom), and finally a page that asks for a Microsoft device code. Landing URLs follow token patterns of the form //it[A-Za-z0-9]{32}us (2026-08-10 to 2026-10-19) and the earlier //zt[A-Za-z0-9]{32}op (2026-06-25 to 2026-09-28).

The kit's JavaScript modules include client_geo.js (victim geolocation via ip-api.com, ipapi.co or ipwho.is), endpoint.js (logs email, password, browser, MFA status and country) and url_helper.js. An administration panel exists at /admin/index.php with a dashboard, server management and link generation. Backend infrastructure is hosted primarily on DigitalOcean (50 of 92 identified backend IPs), and ANY.RUN lists 173 hosting domains, including typo-squatted Microsoft-themed hostnames.

ANY.RUN assesses with high confidence that SkyW4lker and Gabagool share a developer. The evidence is shared JavaScript modules (client_geo.js, url_helper.js, endpoint.js), an identical CAPTCHA implementation, shared landing-token patterns, shared hosting directories on 5200m.com, torvion.life and ghethim.com, and a shared IP (172.86.85.51, priorispace.biz). Gabagool was first observed on 2026-04-23 and SkyW4lker on 2026-06-23. The main functional difference is that Gabagool harvests credentials via accounts.php, while SkyW4lker uses the device-code flow via session_public.php. Sandbox submissions grew from about 20 in June to about 200 in September. Top affected sectors are technology, manufacturing and government, and the top submitting countries are the US, India, Canada and the UK. Severity is analyst-assigned; there is no CVE and the information comes from a single vendor source.

## MITRE ATT&CK

- T1589.002 Email Addresses
- T1590.005 IP Addresses
- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1608.005 Link Target
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1684.001 Impersonation
- T1497 Virtualization/Sandbox Evasion
- T1027 Obfuscated Files or Information
- T1528 Steal Application Access Token
- T1056.003 Web Portal Capture

## Sources

- [SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises](https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/)
- [Storm-2372 conducts device code phishing campaign (Microsoft Threat Intelligence)](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/)
- [Device code phishing campaign (ReversingLabs)](https://reversinglabs.com/blog/device-code-phishing-campaign)
- [AiTM Phishing: Hold the Gabagool - Analyzing the Gabagool Phishing Kit](https://social.cyware.com/news/aitm-phishing-hold-the-gabagool-analyzing-the-gabagool-phishing-kit-d26981f1)
- [New phishing kits target Microsoft 365 accounts, evade MFA (BleepingComputer)](https://bleepingcomputer.com/news/security/new-phishing-kits-target-microsoft-365-accounts-evade-mfa)
- [MITRE ATT&CK T1528 Steal Application Access Token](https://attack.mitre.org/techniques/T1528/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4593