Threat video1:00
SkyW4lker Device-Code Phishing Kits: Detection & IOCs
SkyW4lker and GeorgeGinx kits hijack Microsoft 365 accounts via device-code OAuth. Covers 15 IOCs and 9 detection rules, plus a free Splunk SPL rule.
Read the full threat intel for SkyW4lker Device-Code Phishing Kits: Detection & IOCs →
Chapters
- 0:00The hookAbout 618 device-code analyses from three kits.
- 0:05The storyIn June, device-code phishing began.
- 0:11Attack pathDocuments redirect to fake Microsoft pages.
- 0:27AttributionNo threat actor is attributed.
- 0:32Indicators of compromise4 indicators to hunt: 1 IP and 3 URLs.
- 0:38MITRE ATT&CK techniques20 ATT&CK techniques, from resource development to collection.
- 0:43Remediation4 steps now: Block or sinkhole.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 618 device-code analyses from three kits.
0:05In June, device-code phishing began.
0:08By September, fake AI tools spread.
0:11Documents redirect to fake Microsoft pages.
0:15Victims enter device codes on the login site.
0:17Attacker captures OAuth refresh tokens.
0:20Tokens grant account access without passwords or MFA.
0:27No threat actor is attributed. Confidence: low.
0:324 indicators to hunt: 1 IP and 3 URLs.
0:3820 ATT&CK techniques, from resource development to collection.
0:434 steps now: Block or sinkhole.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.