# SkyW4lker-Associated Microsoft OAuth Phishing via Adobe-Hosted PDF Lure (slybee.com)

> A phishing case study shows a PDF hosted on acrobat.adobe.com whose embedded link leads through a CAPTCHA gate to a Microsoft OAuth phishing flow; a pivot on slybee.com tied it to activity associated with the SkyW4lker phishing kit. ANY.RUN describes SkyW4lker as a device-code phishing kit that obtains Microsoft 365 OAuth tokens without stealing passwords or breaking MFA.

- **Published:** 2026-11-10T17:57:40Z
- **Last reviewed:** 2026-11-10T17:57:40Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5667
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5667.png
- **ID:** TL-2026-5667
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 27 (3 shown free below)

## Description

On 2026-11-10 Cyber Security News published an ANY.RUN-sourced case study in which an interactive sandbox session opened a PDF hosted on the legitimate acrobat.adobe.com platform, followed the embedded link, completed a CAPTCHA, and landed on a Microsoft OAuth phishing flow. A Threat Intelligence Lookup pivot on the domain slybee.com returned 40 related sandbox analyses, 8 associated IPs, 29 related URLs and 41 network connections, with the classifications oauth-ms-phish and skyw4lker. The article gives no PDF filename or hash, no campaign dates and no IP/URL values, only counts. Counts in the article are internally inconsistent (it also cites more than 70 related analyses). The slybee.com domain does not appear in ANY.RUN's primary SkyW4lker report IOC list that was reviewed, so its linkage to SkyW4lker rests on the vendor's tagging and is low confidence.

SkyW4lker (operator brand 'SkyW4lker x365 Sentinel'), documented by ANY.RUN on 2026-10-27, is a PHP-backed phishing kit with obfuscator.io-style JavaScript targeting Microsoft 365 users, mostly in the US (about 46-47% of submissions), with submissions also from India, Canada and the UK, and sectors such as technology, manufacturing and government. ANY.RUN counted 618 sandbox analyses between June and 2026-10-21, growing from about 20 in June to about 200 in September; these are analyzed samples, not confirmed victims. The kit abuses the OAuth 2.0 device-code flow: the victim is shown a device code and told to enter it on Microsoft's real device login page; after the victim completes authentication (including MFA), the attacker obtains an access token. The page calls session_public.php with action=start (registering victim IP and geolocation) and then repeatedly action=poll to detect completion. Supporting modules are client_geo.js (geolocation via third-party APIs), url_helper.js and endpoint.js (logs email, password, browser, MFA status and country to accounts.php). An admin panel at /admin/index.php appears, from CSS class names, to offer Telegram-based MFA, a victim dashboard, link generation and live notifications.

Lure delivery per ANY.RUN: password-protected PDF, DOCX, XLS/XLSX or EML attachments with the password in the email body, impersonating contracts, invoices, proposals and statements ('New Submission From', 'Approved Statement', 'Fedwire Funds Service Processed'). Links go to a CAPTCHA page (self-hosted widget or Cloudflare Turnstile), sometimes via legitimate services such as Google Sites, Miro, Zoom, Axure Cloud, Smartsheet, Cloudflare R2 or Linode object storage. Look-alike hostnames chain Microsoft-themed subdomains (outlook, copilot, onedrive, docshare, auth) and free dynamic-DNS domains. Hosting is mostly DigitalOcean (50 of 92 backend IPs). ANY.RUN reports technical overlap with the Gabagool credential-phishing kit (first seen 2026-04-23; same JS modules, confirm_visit.php endpoint, self-hosted CAPTCHA, landing-token formats and shared hosting directories, including directories named skywalker/skyw4lker on goldcreekconcrete.com/.org) and assesses with high confidence a single developer built both; whether one operator or several customers run them is unknown. Motivation is possibly financial; no named actor or nation-state attribution exists.

## MITRE ATT&CK

- T1589.002 Email Addresses
- T1590.005 IP Addresses
- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1608.005 Link Target
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1684.001 Impersonation
- T1497 Virtualization/Sandbox Evasion
- T1027 Obfuscated Files or Information
- T1528 Steal Application Access Token
- T1056.003 Web Portal Capture

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SkyW4lker Device-Code Phishing Kit Session Start/Poll Endpoint Chain (TL-2026-5667)** (`TL-2026-5667-SPL-001`)

Behaviour-first proxy detection for the SkyW4lker x365 Sentinel kit. The phishing page registers the victim with /assets/php/endpoints/session_public.php?action=start and then repeatedly calls action=poll to learn when the victim has finished entering the device code on Microsoft's real login page. The search also flags the shared Gabagool endpoint confirm_visit.php and the document-themed mstoken_document_(adobe|onedrive|excel) lure script. Repeated polling or any two kit stages from one client is a strong sign the user is inside a device-code phishing flow, so token theft (T1528) may follow.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.002, T1204.001, T1056.003, T1608.005
- **Data sources:** proxy:zscalernss-web, proxy:pan:url, proxy:squid:access, CommonSecurityLog
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=proxy (sourcetype="zscalernss-web" OR sourcetype="pan:url" OR sourcetype="squid:access") earliest=-24h@h
| eval u=lower(coalesce(url, uri, request_url))
| eval stage=case(match(u,"/assets/php/endpoints/session_public[.]php[?]action=start"),"session_start", match(u,"/assets/php/endpoints/session_public[.]php[?]action=poll"),"session_poll", match(u,"/assets/php/endpoints/confirm_visit[.]php"),"confirm_visit", match(u,"/assets/php/attach/js/mstoken_document_(adobe|onedrive|excel)_[a-z0-9]{50}[.]js"),"mstoken_js")
| where isnotnull(stage)
| stats count AS requests, sum(eval(if(stage="session_poll",1,0))) AS poll_count, values(stage) AS stages, dc(stage) AS stage_count, min(_time) AS first_seen, max(_time) AS last_seen BY src_ip, user, dest_host
| where poll_count>=3 OR stage_count>=2 OR stages="mstoken_js" OR stages="session_start"
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table first_seen, last_seen, src_ip, user, dest_host, requests, poll_count, stages
```

### Microsoft KQL

```kql
let kitPattern = @'(?i)/assets/php/endpoints/(session_public[.]php[?]action=(start|poll)|confirm_visit[.]php)|/assets/php/attach/js/mstoken_document_(adobe|onedrive|excel)_[A-Za-z0-9]{50}[.]js';
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where isnotempty(RequestURL)
| where RequestURL matches regex kitPattern
| extend Stage = case(RequestURL has 'action=start', 'session_start', RequestURL has 'action=poll', 'session_poll', RequestURL has 'confirm_visit', 'confirm_visit', 'mstoken_js')
| summarize Requests = count(), PollCount = countif(Stage == 'session_poll'), Stages = make_set(Stage), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, SourceUserName, DestinationHostName
| where PollCount >= 3 or array_length(Stages) >= 2 or set_has_element(Stages, 'mstoken_js') or set_has_element(Stages, 'session_start')
| project FirstSeen, LastSeen, SourceIP, SourceUserName, DestinationHostName, Requests, PollCount, Stages
```

### Sigma

```yaml
title: SkyW4lker Phishing Kit Session Endpoints in Proxy Logs
id: 3f6c1a52-8b7e-4d19-9a3c-5e2d7b1c4f01
status: experimental
description: Detects web requests to the SkyW4lker x365 Sentinel device-code phishing kit session endpoints (session_public.php with action start or poll, and confirm_visit.php) and the document-themed mstoken JavaScript lure path (TL-2026-5667).
references:
  - https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/
  - https://cybersecuritynews.com/ai-powered-malware-analysis/
author: Threadlinqs Team
date: 2026-11-10
tags:
  - attack.initial-access
  - attack.t1566.002
  - attack.execution
  - attack.t1204.001
  - attack.collection
  - attack.t1056.003
logsource:
  category: proxy
detection:
  selection_session:
    c-uri|contains:
      - '/assets/php/endpoints/session_public.php?action=start'
      - '/assets/php/endpoints/session_public.php?action=poll'
  selection_confirm:
    c-uri|contains: '/assets/php/endpoints/confirm_visit.php'
  selection_mstoken:
    c-uri|re: '/assets/php/attach/js/mstoken_document_(adobe|onedrive|excel)_[A-Za-z0-9]{50}[.]js'
  condition: 1 of selection_*
falsepositives:
  - Security researchers or sandboxes (for example ANY.RUN style detonation) browsing to the kit
  - Threat-intel scanners replaying known-bad URLs
level: high
```

**Known false positives:**

- SOC or malware-analysis staff detonating the kit URLs in a sandbox
- Threat-intelligence crawlers or URL scanners replaying known-bad URLs
- Unrelated PHP applications that reuse the generic confirm_visit.php name (very rare, the full /assets/php/endpoints/ path is required)

**Tuning notes:** Adjust the sourcetype list and the url/uri/request_url field coalesce to match your proxy add-on CIM mapping. Raise the poll_count threshold if a clean baseline shows none. Exclude your own sandbox egress IPs. Every hit should trigger the Entra device-code hunt (TL-2026-5667-SPL-002) for the same user within the following 15 minutes.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SkyW4lker Lure Chain: Cloudflare R2 Staging Page and Landing-Token URL Clicked (locked: unlock with TL Creds)
- Entra Device-Code Sign-In Not Governed by Conditional Access (locked: unlock with TL Creds)
- Microsoft-Themed Look-Alike and Dynamic-DNS Phishing Hostnames (SkyW4lker) (locked: unlock with TL Creds)
- SkyW4lker Kit Hosting Directories and JavaScript Modules in Web Requests (locked: unlock with TL Creds)
- Device-Code Sign-In Using Commonly Abused First-Party Microsoft Client IDs (locked: unlock with TL Creds)
- Community-Observed SkyW4lker-Related Phishing Infrastructure (OSINT Siblings) (locked: unlock with TL Creds)
- Successful Entra ID Device-Code Sign-In (SkyW4lker Token Theft Outcome) (locked: unlock with TL Creds)
- SkyW4lker/Gabagool Known Kit Infrastructure Contact (Domains and DigitalOcean IPs) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 27)

Defanged, TLP:CLEAR.

- IP address: `172.86.85[.]51`
- Domain: `slybee[.]com`
- File hash: `9aa0b87974b9b4cd42603833b7ad44257578467d279b315a071108a5ed02c268`

Full set of 27 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [AI-Powered Malware Analysis: From Hidden Phishing Attacks to Faster SOC Response](https://cybersecuritynews.com/ai-powered-malware-analysis/)
- [ANY.RUN: SkyW4lker Phishing Kit: Microsoft 365 Threat to US Firms](https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/)
- [ANY.RUN sandbox task for the Adobe PDF to Microsoft OAuth phishing investigation](https://app.any.run/tasks/2573e1ee-34b0-4ca5-9209-fa16decac7d6/)
- [SkyW4lker Phishing Campaign Expands, Threatening US Enterprises with Microsoft 365 Account Takeovers](https://cybersecuritynews.com/skyw4lker-phishing-campaign-expands-threatening-us-enterprises-with-microsoft-365-account-takeovers/)
- [GuardPilot: SkyW4lker: Microsoft 365 Device Code Phishing](https://guardpilot.io/blog/skyw4lker-microsoft-365-device-code-phishing)
- [MalwareTips: SkyW4lker Phishing Scam: A Real Microsoft Login Can Hand Over Your Account](https://malwaretips.com/blogs/skyw4lker-device-code-phishing-scam-microsoft-login/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5667