"The FBI's Internet Crime Complaint Center recorded 193,407 phishing and spoofing complaints in 2024." That figure, cited by ANY.RUN in its analysis of a new device code phishing campaign called Skyw4lker, sets the stage for a threat that blends legitimate cloud services with social engineering to bypass traditional identity defenses.
How Skyw4lker weaponizes device code authentication
ANY.RUN's investigation describes Skyw4lker as a device code phishing campaign that avoids the conventional fake-login-page playbook. Instead of harvesting credentials directly, attackers initiate a legitimate device authorization flow and persuade a targeted employee to complete it. When the victim follows the flow, the attacker receives Microsoft 365 authentication tokens tied to that account. The deception rests not in faking Microsoft's sign-in window perfectly, but in obtaining a valid authentication event that appears legitimate in identity logs.
The technical trail: Google-hosted lures, obfuscated JavaScript, and a PHP backend
The initial lure in Skyw4lker typically arrives as a password-protected document framed as a contract or service proposal—content that appears credible in manufacturing, procurement, and vendor workflows. The document points victims to a page on sites[.]google[.]com, which subsequently leads into a Microsoft authentication flow. A static inspection of the document can reveal the starting URL, but the malicious behavior emerges only once the browser executes obfuscated JavaScript and interacts with a PHP backend that creates a victim session, records IP and geolocation, and polls while waiting for the authentication to complete.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildWhy device code phishing can slip past identity telemetry
Because the authentication is valid, security teams may see a normal sign-in event without immediate signs of malicious intent. ANY.RUN emphasizes that understanding Skyw4lker requires correlating the document, browser activity, redirects, backend communication, and the authentication flow. Behavioral analysis—observing JavaScript execution, network traffic, and real-time redirects—is therefore essential to distinguish benign logins from those induced by an attacker-controlled device code flow.
What this means for technologists, MSSPs, and U.S. healthcare & manufacturing organizations
- Technologists and security teams: They must look beyond credential telemetry to connect web and authentication artifacts. Interactive sandboxing and behavioral traces help identify the session-level actions that static file inspection misses.
- MSSPs and SOCs: An investigation into a single compromised customer can generate indicators that are valuable across multiple clients. ANY.RUN notes that indicators tied to one Skyw4lker incident can be searched across a provider's customer base and integrated into monitoring.
- U.S. healthcare, manufacturing, and technology companies: A compromised Microsoft 365 account can expose regulated data, intellectual property, and operational communications; early identification of related activity is therefore critical for limiting damage.
Operational tools: interactive sandboxing, TI Feeds, and automated integrations
ANY.RUN positions interactive sandboxing as the practical way to convert a suspicious file or link into actionable intelligence. In its environment, analysts can execute and interact with suspicious artifacts, watch redirects and authentication activity, inspect screenshots and network communication, and produce indicators of compromise (IOCs) and behavioral evidence in as little as 40 seconds. According to ANY.RUN, this workflow can reduce Tier 1 workload by up to 20% and help analysts reach confident verdicts faster.
ANY.RUN's Threat Intelligence Feeds (TI Feeds) aggregate malicious IPs, domains, and URLs validated after sandbox investigations; the company reports that 99% of unique, high-confidence IOCs are added to TI Feeds post-validation. Internally, ANY.RUN found that up to 30% of unique malicious IOCs discovered in Interactive Sandbox sessions had been previously observed and already present in TI Feeds—illustrating how preexisting intelligence can speed detection. Analysts can also use TI Lookup and TI Reports to tie an indicator to campaigns, infrastructure, and observed behavior, and push findings into SIEM, TIP, XDR, or via STIX/TAXII and API/SDK integrations.
Skyw4lker demonstrates a practical shift in phishing: the attacker does not need to steal a password to gain access—the attacker needs only to make a legitimate authentication serve their purposes. Defenders who confine their detection to credential anomalies will find this class of attack opaque unless they instrument browser, network, and session behaviors and fold validated sandbox intelligence into monitoring and response workflows.
https://thehackernews.com/2026/10/american-organizations-under-attack.html
