SkyW4lker-Associated Microsoft OAuth Phishing via Adobe-Hosted PDF Lure (slybee.com)

Key facts

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5667 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SkyW4lker Device-Code Phishing Kit Session Start/Poll Endpoint Chain (TL-2026-5667)

Behaviour-first proxy detection for the SkyW4lker x365 Sentinel kit. The phishing page registers the victim with /assets/php/endpoints/session_public.php?action=start and then repeatedly calls action=poll to learn when the victim has finished entering the device code on Microsoft's real login page. The search also flags the shared Gabagool endpoint confirm_visit.php and the document-themed mstoken_document_(adobe|onedrive|excel) lure script. Repeated polling or any two kit stages from one client is a strong sign the user is inside a device-code phishing flow, so token theft (T1528) may follow.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.002, T1204.001, T1056.003, T1608.005
• Data sources: proxy:zscalernss-web, proxy:pan:url, proxy:squid:access, CommonSecurityLog
• Severity: high
• Confidence: high

Splunk SPL

index=proxy (sourcetype="zscalernss-web" OR sourcetype="pan:url" OR sourcetype="squid:access") earliest=-24h@h
| eval u=lower(coalesce(url, uri, request_url))
| eval stage=case(match(u,"/assets/php/endpoints/session_public[.]php[?]action=start"),"session_start", match(u,"/assets/php/endpoints/session_public[.]php[?]action=poll"),"session_poll", match(u,"/assets/php/endpoints/confirm_visit[.]php"),"confirm_visit", match(u,"/assets/php/attach/js/mstoken_document_(adobe|onedrive|excel)_[a-z0-9]{50}[.]js"),"mstoken_js")
| where isnotnull(stage)
| stats count AS requests, sum(eval(if(stage="session_poll",1,0))) AS poll_count, values(stage) AS stages, dc(stage) AS stage_count, min(_time) AS first_seen, max(_time) AS last_seen BY src_ip, user, dest_host
| where poll_count>=3 OR stage_count>=2 OR stages="mstoken_js" OR stages="session_start"
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table first_seen, last_seen, src_ip, user, dest_host, requests, poll_count, stages

Microsoft KQL

let kitPattern = @'(?i)/assets/php/endpoints/(session_public[.]php[?]action=(start|poll)|confirm_visit[.]php)|/assets/php/attach/js/mstoken_document_(adobe|onedrive|excel)_[A-Za-z0-9]{50}[.]js';
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where isnotempty(RequestURL)
| where RequestURL matches regex kitPattern
| extend Stage = case(RequestURL has 'action=start', 'session_start', RequestURL has 'action=poll', 'session_poll', RequestURL has 'confirm_visit', 'confirm_visit', 'mstoken_js')
| summarize Requests = count(), PollCount = countif(Stage == 'session_poll'), Stages = make_set(Stage), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, SourceUserName, DestinationHostName
| where PollCount >= 3 or array_length(Stages) >= 2 or set_has_element(Stages, 'mstoken_js') or set_has_element(Stages, 'session_start')
| project FirstSeen, LastSeen, SourceIP, SourceUserName, DestinationHostName, Requests, PollCount, Stages

Sigma

title: SkyW4lker Phishing Kit Session Endpoints in Proxy Logs
id: 3f6c1a52-8b7e-4d19-9a3c-5e2d7b1c4f01
status: experimental
description: Detects web requests to the SkyW4lker x365 Sentinel device-code phishing kit session endpoints (session_public.php with action start or poll, and confirm_visit.php) and the document-themed mstoken JavaScript lure path (TL-2026-5667).
references:
  - https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/
  - https://cybersecuritynews.com/ai-powered-malware-analysis/
author: Threadlinqs Team
date: 2026-11-10
tags:
  - attack.initial-access
  - attack.t1566.002
  - attack.execution
  - attack.t1204.001
  - attack.collection
  - attack.t1056.003
logsource:
  category: proxy
detection:
  selection_session:
    c-uri|contains:
      - '/assets/php/endpoints/session_public.php?action=start'
      - '/assets/php/endpoints/session_public.php?action=poll'
  selection_confirm:
    c-uri|contains: '/assets/php/endpoints/confirm_visit.php'
  selection_mstoken:
    c-uri|re: '/assets/php/attach/js/mstoken_document_(adobe|onedrive|excel)_[A-Za-z0-9]{50}[.]js'
  condition: 1 of selection_*
falsepositives:
  - Security researchers or sandboxes (for example ANY.RUN style detonation) browsing to the kit
  - Threat-intel scanners replaying known-bad URLs
level: high

Known false positives:

• SOC or malware-analysis staff detonating the kit URLs in a sandbox
• Threat-intelligence crawlers or URL scanners replaying known-bad URLs
• Unrelated PHP applications that reuse the generic confirm_visit.php name (very rare, the full /assets/php/endpoints/ path is required)

Tuning notes: Adjust the sourcetype list and the url/uri/request_url field coalesce to match your proxy add-on CIM mapping. Raise the poll_count threshold if a clean baseline shows none. Exclude your own sandbox egress IPs. Every hit should trigger the Entra device-code hunt (TL-2026-5667-SPL-002) for the same user within the following 15 minutes.

• 🔒 SkyW4lker Lure Chain: Cloudflare R2 Staging Page and Landing-Token URL Clicked · unlock with TL Creds
• 🔒 Entra Device-Code Sign-In Not Governed by Conditional Access · unlock with TL Creds
• 🔒 Microsoft-Themed Look-Alike and Dynamic-DNS Phishing Hostnames (SkyW4lker) · unlock with TL Creds
• 🔒 SkyW4lker Kit Hosting Directories and JavaScript Modules in Web Requests · unlock with TL Creds
• 🔒 Device-Code Sign-In Using Commonly Abused First-Party Microsoft Client IDs · unlock with TL Creds
• 🔒 Community-Observed SkyW4lker-Related Phishing Infrastructure (OSINT Siblings) · unlock with TL Creds
• 🔒 Successful Entra ID Device-Code Sign-In (SkyW4lker Token Theft Outcome) · unlock with TL Creds
• 🔒 SkyW4lker/Gabagool Known Kit Infrastructure Contact (Domains and DigitalOcean IPs) · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 27 indicators of compromise for TL-2026-5667.

Sample indicators (3 of 27)

• IP address: 172.86.85[.]51
• Domain: slybee[.]com
• File hash: 9aa0b87974b9b4cd42603833b7ad44257578467d279b315a071108a5ed02c268

Defanged, TLP:CLEAR. Full set of 27 indicators: unlock with TL Creds.

Community OSINT corroboration

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

On 2026-11-10 Cyber Security News published an ANY.RUN-sourced case study in which an interactive sandbox session opened a PDF hosted on the legitimate acrobat.adobe.com platform, followed the embedded link, completed a CAPTCHA, and landed on a Microsoft OAuth phishing flow. A Threat Intelligence Lookup pivot on the domain slybee.com returned 40 related sandbox analyses, 8 associated IPs, 29 related URLs and 41 network connections, with the classifications oauth-ms-phish and skyw4lker. The article gives no PDF filename or hash, no campaign dates and no IP/URL values, only counts. Counts in the article are internally inconsistent (it also cites more than 70 related analyses). The slybee.com domain does not appear in ANY.RUN's primary SkyW4lker report IOC list that was reviewed, so its linkage to SkyW4lker rests on the vendor's tagging and is low confidence.

SkyW4lker (operator brand 'SkyW4lker x365 Sentinel'), documented by ANY.RUN on 2026-10-27, is a PHP-backed phishing kit with obfuscator.io-style JavaScript targeting Microsoft 365 users, mostly in the US (about 46-47% of submissions), with submissions also from India, Canada and the UK, and sectors such as technology, manufacturing and government. ANY.RUN counted 618 sandbox analyses between June and 2026-10-21, growing from about 20 in June to about 200 in September; these are analyzed samples, not confirmed victims. The kit abuses the OAuth 2.0 device-code flow: the victim is shown a device code and told to enter it on Microsoft's real device login page; after the victim completes authentication (including MFA), the attacker obtains an access token. The page calls session_public.php with action=start (registering victim IP and geolocation) and then repeatedly action=poll to detect completion. Supporting modules are client_geo.js (geolocation via third-party APIs), url_helper.js and endpoint.js (logs email, password, browser, MFA status and country to accounts.php). An admin panel at /admin/index.php appears, from CSS class names, to offer Telegram-based MFA, a victim dashboard, link generation and live notifications.

Lure delivery per ANY.RUN: password-protected PDF, DOCX, XLS/XLSX or EML attachments with the password in the email body, impersonating contracts, invoices, proposals and statements ('New Submission From', 'Approved Statement', 'Fedwire Funds Service Processed'). Links go to a CAPTCHA page (self-hosted widget or Cloudflare Turnstile), sometimes via legitimate services such as Google Sites, Miro, Zoom, Axure Cloud, Smartsheet, Cloudflare R2 or Linode object storage. Look-alike hostnames chain Microsoft-themed subdomains (outlook, copilot, onedrive, docshare, auth) and free dynamic-DNS domains. Hosting is mostly DigitalOcean (50 of 92 backend IPs). ANY.RUN reports technical overlap with the Gabagool credential-phishing kit (first seen 2026-04-23; same JS modules, confirm_visit.php endpoint, self-hosted CAPTCHA, landing-token formats and shared hosting directories, including directories named skywalker/skyw4lker on goldcreekconcrete.com/.org) and assesses with high confidence a single developer built both; whether one operator or several customers run them is unknown. Motivation is possibly financial; no named actor or nation-state attribution exists.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1497 Virtualization/Sandbox Evasion; T1684.001 Impersonation

Collection

T1056.003 Web Portal Capture

Execution

T1204.001 Malicious Link

Credential Access

T1528 Steal Application Access Token

Initial Access

T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link

Resource Development

T1583.001 Domains; T1583.003 Virtual Private Server; T1608.005 Link Target

Reconnaissance

T1589.002 Email Addresses; T1590.005 IP Addresses

Remediation

Immediate actions

• Block or sinkhole the SkyW4lker domains, hostnames and IPs listed in the IOCs, and alert on web requests to /assets/php/endpoints/session_public.php with action=start followed by repeated action=poll
• In Microsoft Entra ID sign-in logs, filter for device-code authentications and correlate with suspicious emails sent to the same user shortly before
• If compromise is suspected: revoke sessions and refresh tokens, reset credentials, and review mailbox rules, OAuth app consents, SharePoint/OneDrive access and outbound mail from the account

Workarounds

• Treat links to content hosted on trusted platforms (for example acrobat.adobe.com PDFs) that lead to CAPTCHA pages and Microsoft sign-in prompts as suspicious
• MFA remains advisable but does not stop device-code phishing because the victim completes MFA on Microsoft's real page

Longer-term hardening

• Restrict device-code authentication flow with Entra Conditional Access (start in report-only mode) and allow it only for documented use cases such as headless devices, CLI tools or specific Teams hardware
• Correlate email, web and identity telemetry so attachment, phishing infrastructure and resulting authentication event can be linked
• Detonate password-protected attachments and CAPTCHA-gated links in an interactive sandbox rather than relying on static scanning
• Train users never to enter a device code that arrived unexpectedly

Affected and fixed versions

• Microsoft — Microsoft 365 / Entra ID (OAuth 2.0 device authorization grant)
  Vulnerable versions: Tenants permitting device-code authentication flow

Timeline

• 2026-04-23 Related Gabagool credential-phishing kit first seen (shares JS modules, endpoints and CAPTCHA with SkyW4lker per ANY.RUN).
• 2026-06-23 SkyW4lker kit first appears in ANY.RUN sandbox data (earliest observed IOCs).
• 2026-06-25 Earlier landing-token format //zt[A-Za-z0-9]{32}op first observed (seen through 2026-09-28).
• 2026-08-10 Current landing-token format //it[A-Za-z0-9]{32}us first observed (seen through 2026-10-19).
• 2026-10-21 End of ANY.RUN's 618-analysis window; monthly submissions grew from about 20 in June to about 200 in September.
• 2026-10-27 ANY.RUN publishes its SkyW4lker phishing kit analysis, assessing with high confidence a shared developer with Gabagool.
• 2026-11-10 Cyber Security News publishes an ANY.RUN case study of an locked-ioc-9 PDF lure leading to a CAPTCHA and Microsoft OAuth phishing flow, pivoted to locked-ioc-20 and tagged skyw4lker.

Sources cited

• ANY.RUN: SkyW4lker Phishing Kit: Microsoft 365 Threat to US Firms any.run · Research · 2026-10-27
• ANY.RUN sandbox task for the Adobe PDF to Microsoft OAuth phishing investigation app.any.run · Research · 2026-11-10
• GuardPilot: SkyW4lker: Microsoft 365 Device Code Phishing guardpilot.io · Blog · 2026-10-28
• MalwareTips: SkyW4lker Phishing Scam: A Real Microsoft Login Can Hand Over Your Account malwaretips.com · Blog
• AI-Powered Malware Analysis: From Hidden Phishing Attacks to Faster SOC Response cybersecuritynews.com · News · 2026-11-10
• SkyW4lker Phishing Campaign Expands, Threatening US Enterprises with Microsoft 365 Account Takeovers cybersecuritynews.com · News

More in phishing

• Utility Impostor Scams: Lookalike Domains, Scam Ads and Phishing-as-a-Service (Darcula V3) Targeting Utility Customers
• 110-Domain Fake Copyright-Strike (DMCA/YouTube) Phishing Estate Using Browser-in-the-Browser Google Credential Harvesting
• Holiday Phishing Scams 2026: Black Friday-Themed Phishing, Quishing, Callback Fraud and BEC Targeting Employees
• BluePhishing: Initial Access via Third-Party Agent Blueprint Consent (Microsoft Entra Agent ID)
• Large-Scale Tech Support Scam Email Campaign Targeting Users and Organizations in Japan (13M+ Emails)