A phishing campaign known as Skyw4lker is targeting U.S. organizations by abusing legitimate authentication services to gain access to Microsoft 365 accounts.
Rather than relying on conventional fake login pages to steal passwords, the campaign uses device code phishing, a technique that can trick victims into authorizing an authentication request initiated by attackers.
According to an analysis by cybersecurity company ANY.RUN, the campaign has targeted organizations in manufacturing, technology, and healthcare. Attackers use business-themed documents, Google-hosted infrastructure, and Microsoft’s legitimate authentication processes to make their activity appear less suspicious.
The campaign highlights how attackers are adapting their methods to bypass security measures, including multi-factor authentication (MFA), by exploiting trusted authentication workflows instead of directly stealing login credentials.
Skyw4lker typically begins with a password-protected document disguised as a contract or service proposal. Such documents can appear routine in workplaces where employees regularly handle vendor agreements, procurement paperwork, and business proposals.
When a victim opens the document, they are directed to a page hosted on Google Sites before being redirected into a Microsoft authentication flow. The attacker relies on the victim completing an authentication request that the attacker initiated.
Because the authentication process itself can be legitimate, the victim may not realize that they are authorizing access for someone else. Once the process is completed, attackers can obtain Microsoft 365 authentication tokens and potentially access resources available to the compromised account.
This approach can make the activity difficult to identify through authentication logs alone. Security teams may see a valid sign-in event without immediately recognizing the phishing activity that led to it. Investigators must connect the original document, browser activity, redirects, authentication events, and related infrastructure to understand the full attack chain.
ANY.RUN’s analysis also identified obfuscated JavaScript and a PHP backend supporting the Skyw4lker phishing infrastructure. These components were used to create victim sessions, collect information such as IP addresses and geolocation, and repeatedly check the backend while waiting for victims to complete the authentication process.
Examining the original document may reveal the initial URL, but it does not necessarily show the entire operation. The campaign’s behavior becomes clearer when analysts examine browser interactions, JavaScript execution, server communications, redirects, and authentication activity together.
Interactive sandboxing can help security teams investigate these behaviors in an isolated environment. By executing suspicious files and visiting malicious URLs safely, analysts can observe the attack in action and collect indicators of compromise (IOCs), including suspicious domains, URLs, IP addresses, and network activity.
ANY.RUN says its Interactive Sandbox can produce investigation results in as little as 40 seconds. The resulting evidence can help security operations center (SOC) teams validate alerts, identify affected users, and develop detections without manually reconstructing the attack across multiple tools.
Threat intelligence can further help organizations identify related activity. ANY.RUN’s Threat Intelligence Feeds provide information about malicious IP addresses, domains, URLs, and other indicators gathered through sandbox investigations. The company says 99% of unique, high-confidence indicators added to its feeds undergo validation.
According to ANY.RUN’s internal analysis, up to 30% of unique malicious indicators discovered during Interactive Sandbox sessions had already been observed and were available in its threat intelligence feeds. This means security teams may be able to recognize known malicious infrastructure before conducting a full investigation.
The company’s Threat Intelligence Lookup and Threat Intelligence Reports services can also help analysts examine an indicator’s history and identify connections between suspicious infrastructure, attack campaigns, and known malicious activity.
These capabilities are particularly relevant to organizations in healthcare, manufacturing, and technology, where compromised Microsoft 365 accounts could expose sensitive communications, intellectual property, business information, and regulated data.
Security teams and managed security service providers can also use findings from one investigation to search for related activity across other systems or customer environments. ANY.RUN supports integrations through APIs, SDKs, STIX/TAXII, SIEM, threat intelligence platforms, and extended detection and response systems.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The Skyw4lker campaign demonstrates why organizations cannot rely solely on password protection or the appearance of a legitimate sign-in to determine whether an account is safe. Investigating the surrounding authentication flow, suspicious documents, browser behavior, and associated infrastructure can help security teams identify attacks that might otherwise go unnoticed.
