Skyw4lker device code phishing campaign targets U.S. manufacturing, technology and healthcare to steal Microsoft 365 tokens
ANY.RUN documented Skyw4lker, a device code phishing campaign aimed mainly at U.S. organizations in manufacturing, technology and healthcare. Victims receive a password-protected document disguised as a contract or service proposal. It leads them to a page on sites[.]google[.]com and then into a legitimate Microsoft authentication flow. Because the victim completes an attacker-initiated device authorization, the attacker obtains Microsoft 365 tokens without stealing credentials, so identity telemetry alone shows only a valid sign-in. The article is partly promotional for ANY.RUN's sandbox and threat intelligence products, and it gives no victim counts, actor attribution or full IOC list.
Detalhes técnicos
- Lure: password-protected business document (contract or proposal) that directs the victim to a Google Sites page and then to a Microsoft device authorization flow.
- Phishing page: obfuscated JavaScript and a PHP backend that creates a victim session and collects the victim's IP address and geolocation. The page polls the backend repeatedly until authentication completes.
- Impact: the attacker obtains Microsoft 365 tokens for the compromised account, which can expose sensitive communications, intellectual property, operational information and regulated data.
- Static inspection of the document may reveal only the starting URL. Behavioral analysis is needed to link the document, browser activity, redirects, backend communication and the authentication flow.
Remediação
- Trace the full authentication flow in an interactive sandbox and extract the URLs, domains and IPs involved.
- Hunt for the extracted indicators across historical telemetry and other environments to find additional affected users.
- Correlate sign-in events with the document and web activity that preceded them, since the authentication event itself looks valid.
Linha do tempo
-
Skyw4lker device code phishing campaign targets U.S. manufacturing, technology and healthcare to steal Microsoft 365 tokens
ler a análise desta fonte ocultar
ANY.RUN documented Skyw4lker, a device code phishing campaign aimed mainly at U.S. organizations in manufacturing, technology and healthcare. Victims receive a password-protected document disguised as a contract or service proposal. It leads them to a page on sites[.]google[.]com and then into a legitimate Microsoft authentication flow. Because the victim completes an attacker-initiated device authorization, the attacker obtains Microsoft 365 tokens without stealing credentials, so identity telemetry alone shows only a valid sign-in. The article is partly promotional for ANY.RUN's sandbox and threat intelligence products, and it gives no victim counts, actor attribution or full IOC list.
Technical Details
- Lure: password-protected business document (contract or proposal) that directs the victim to a Google Sites page and then to a Microsoft device authorization flow.
- Phishing page: obfuscated JavaScript and a PHP backend that creates a victim session and collects the victim's IP address and geolocation. The page polls the backend repeatedly until authentication completes.
- Impact: the attacker obtains Microsoft 365 tokens for the compromised account, which can expose sensitive communications, intellectual property, operational information and regulated data.
- Static inspection of the document may reveal only the starting URL. Behavioral analysis is needed to link the document, browser activity, redirects, backend communication and the authentication flow.
Remediation
- Trace the full authentication flow in an interactive sandbox and extract the URLs, domains and IPs involved.
- Hunt for the extracted indicators across historical telemetry and other environments to find additional affected users.
- Correlate sign-in events with the document and web activity that preceded them, since the authentication event itself looks valid.