SkyW4lker Phishing Asks for a Code, Not Your Microsoft 365 Password

A phishing kit called SkyW4lker is tricking Microsoft 365 users into typing a code on Microsoft’s real sign-in page, which hands the attacker a working login without a password or a beaten MFA prompt, ANY.RUN reports. The sandbox company counted 618 analyses of the kit between June and Oct. 21, with monthly submissions rising from 20 to 200, and found it on 173 domains. About half of the submissions came from the US.

5200m[.]com
torvion[.]life
ghethim[.]com
priorispace[.]biz
goldcreekconcrete[.]com
csr-rooflng[.]com
flow505.mooo[.]com
off365acess.jumpingcrab[.]com
pub-177b3aa5a54d4f9087a649de5ec766d5.r2[.]dev
162.243.64[.]121
67.205.154[.]32
172.86.85[.]51

Lure 9aa0b87974b9b4cd42603833b7ad44257578467d279b315a071108a5ed02c268

Source article: SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises
Publisher: ANY.RUN (author: ShiFu, Threat Intelligence Analyst)
Published: October 27, 2026
URL: https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/

Executive Summary

ANY.RUN tracks SkyW4lker, a PHP phishing kit that takes over Microsoft 365 accounts through the OAuth device code flow rather than by stealing passwords. It assesses with high confidence that the kit comes from the same developer as Gabagool, a credential-harvesting kit seen since April 23, 2026; the two share JavaScript modules, a visit-confirmation endpoint, a self-hosted CAPTCHA, landing-token formats and at least one server (172.86.85[.]51), although ANY.RUN notes the shared directories could also mean several customers of one platform. No vendor has named the operators, and ANY.RUN assesses them as financially motivated. Between June 23 and Oct. 21, 2026 ANY.RUN’s sandbox recorded 618 SkyW4lker analyses, with monthly submissions rising from 20 to 200, about 46% of them from the US, mostly from technology, manufacturing and government organizations, across 173 kit domains and 92 backend IPs (50 on DigitalOcean). The chain starts with an email carrying a password-protected PDF, DOCX, XLSX or EML attachment, the password given in the message body, themed as a contract, invoice, proposal or wire confirmation. The document links, sometimes through a Google Sites, Miro, Zoom, Smartsheet or Axure page or a cloud-storage HTML file, to a Cloudflare Turnstile or self-hosted CAPTCHA, then to a page that shows a device code and tells the victim to enter it at Microsoft’s genuine device login. While the victim does that, the kit’s backend registers the visit with session_public.php?action=start and polls action=poll every few seconds until Microsoft issues tokens to the attacker’s session; a separate script also captures email, password, MFA status and location if the victim types them. The objective is access to the victim’s Microsoft 365 mailbox and files with a valid token, and the impact is account takeover that ordinary password resets and MFA prompts do not prevent. Hunt leads, false-positive expectations and indicators are detailed below; ANY.RUN published no YARA, Sigma or Suricata rules.

ATT&CK chain: Reconnaissance → Resource Development → Initial Access → Execution → Defense Evasion → Credential Access → Collection

Hunt Lead Grid

SkyW4lker Kit Endpoint and Script Path Sweep

ANY.RUN documents the kit’s web paths in detail, and they appear in proxy logs for any user who reached a SkyW4lker page. The landing URL carries a token matching it[A-Za-z0-9]{32}us (seen Aug. 10 to Oct. 19, 2026, sometimes ending in ? or ??) or the earlier zt[A-Za-z0-9]{32}op (June 25 to Sept. 28). The page then loads /assets/js/client_geo.js, /assets/js/endpoint.js and /assets/js/url_helper.js, a self-hosted CAPTCHA at /assets/private_captcha/public/widget.js?v=4 with /assets/php/endpoints/private_captcha_challenge.php, calls /assets/php/endpoints/confirm_visit.php, and pulls a brand script matching /assets/php/attach/js/mstoken_document_(adobe|onedrive|excel)_[A-Za-z0-9]{50}.js. The device-code session itself is /assets/php/endpoints/session_public.php?action=start (posting the visitor’s IP, country, city, ISP, org and timezone) followed by repeated session_public.php?action=poll&session_id= every few seconds; credential capture goes to php/endpoints/accounts.php, which is also Gabagool’s main endpoint. The detection logic is a proxy or secure web gateway search for any request whose path contains session_public.php with action=start or action=poll, private_captcha_challenge.php, mstoken_document_, or confirm_visit.php together with client_geo.js, and for landing paths matching either token pattern; geolocation lookups to ip-api[.]com, ipapi[.]co or ipwho[.]is from a browser in the same minute add context but are too common to alert on alone.

Use secure web gateway, proxy or TLS-inspecting firewall logs, which are the only sources that see the full path; DNS logs will not. Sweep back to June 23, 2026, the kit’s first sighting, and to April 2026 for the shared Gabagool paths. Scope is every user, with priority on finance, legal, procurement and executive mailboxes, which the contract and wire themes target. Do not alert on endpoint.js or url_helper.js by name alone, since legitimate web apps use those names; the /assets/js/ plus /assets/php/endpoints/ combination is what narrows it. ANY.RUN’s own TI Lookup query for the modules is url:"/js/client_geo.js" or url:"/js/url_helper.js" or url:"/js/endpoint.js", useful for pivoting to new domains. A long run of action=poll requests means a victim had the code page open, and any hit followed by a device code sign-in for that user (see the device code lead) should go straight to incident response for token revocation. Because the paths are shared with Gabagool, this sweep also covers that kit’s credential-harvesting pages.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Initial Access → T1566.002 (Phishing: Spearphishing Link); Collection / Credential Access → T1056.003 (Input Capture: Web Portal Capture) (mapping per source article).

Sources: “SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises”, ANY.RUN, Oct. 27, 2026, https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/ (source article)

SkyW4lker and Gabagool Infrastructure Sweep

ANY.RUN lists 173 kit domains and a set of staging pages and IPs. Examples are look-alike multi-label Microsoft hostnames such as auth.login.office365.cloud.onedrive.outlook.atlarchitacts[.]com, sdocshares.auth.outlook2026common.copilos26.csr-rooflng[.]com, pdocshared.payments2026.outlooks.common.ecmholdlnggroup[.]com and acrobat-adobe-com-4464uswc.egllo[.]com; free dynamic-DNS names flow505.mooo[.]com, bigbrain.chickenkiller[.]com and off365acess.jumpingcrab[.]com; shared-host directories 5200m[.]com/kvme2/, torvion[.]life/ofulium/ and ghethim[.]com/hyllen/; Gabagool-linked goldcreekconcrete[.]com/skywalker/example/, goldcreekconcrete[.]com/example/skywalker/, goldcreekconcrete[.]org/skyw4lker/skydirectory/ and priorispace[.]biz; and staging pages pub-177b3aa5a54d4f9087a649de5ec766d5.r2[.]dev/docsonedrive2026.html, carcabaoperadologistca.fr-par-1.linodeobjects[.]com/document_excel.html, bethom-contracting-llc.mintlify[.]site and sites.google[.]com/heatherrasekhomes.com/talbert-manufacturing-inc-0049/home. Backend IP examples are 162.243.64[.]121, 67.205.154[.]32 and 172.86.85[.]51 (shared with Gabagool). ANY.RUN also publishes the hostname pattern (docshare|sdocshares|pdocshared|pdfdocshared|efaxdoc|reauth|statement|copilot|login|auth).*(outlook|onedrive|copilot|office365).*, which catches the look-alike style on domains Microsoft does not own. The detection logic is an exact-match sweep of DNS, proxy and firewall logs for the listed hosts, URLs and IPs, plus a regex sweep of DNS query names with that pattern, excluding Microsoft-owned zones.

Use DNS resolver logs for the domains and the regex, proxy logs for the full staging URLs, firewall or NetFlow for the IPs, and mail gateway URL-click logs for links inside messages. Pull the full 173-domain list from the article’s IOC section rather than relying on this sample, and sweep back to April 2026 to cover Gabagool. Blocking the specific hostnames and staging URLs is reasonable; blocking r2[.]dev, linodeobjects[.]com, mintlify[.]site, sites.google[.]com or the dynamic-DNS parent zones wholesale is usually the wrong control because legitimate users depend on them, and the operators rotate subdomains cheaply. Blocking DigitalOcean ranges is also impractical. A DNS-only hit means someone resolved the name, possibly via a mail scanner; confirm with proxy or click logs before treating it as a visit, then hand confirmed visits to the device code lead. The look-alike regex generalizes to other Microsoft 365 phishing kits.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Resource Development → T1583.001 (Acquire Infrastructure: Domains), T1608.005 (Stage Capabilities: Link Target) (mapping per source article; the source also lists T1583.003 (Acquire Infrastructure: Virtual Private Server) for the DigitalOcean backends).

Sources: “SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises”, ANY.RUN, Oct. 27, 2026, https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/ (source article)

Password-Protected Attachment With the Password in the Body

Every SkyW4lker chain ANY.RUN describes starts with an encrypted attachment, a PDF, DOCX, XLSX or EML, and the password printed in the same email, which stops mail gateways from opening the file to follow the link inside. Subjects imitate routine business: contracts, invoices, proposals, confidential documents and wire confirmations, sometimes with the recipient’s email address carried into the landing URL. The one example hash ANY.RUN publishes, SHA-256 9aa0b87974b9b4cd42603833b7ad44257578467d279b315a071108a5ed02c268, is listed as such an attachment; AlienVault OTX’s analysis of the same file identifies it as an encrypted PDF 1.5 with no JavaScript, consistent with a lure that only carries a link. The detection logic is a mail-gateway rule that flags inbound messages from external senders with an encrypted Office, PDF or EML attachment where the message body contains a password string (for example “password”, “passcode” or “PIN” near a short token), raised in severity when the subject matches contract, invoice, proposal, statement or wire themes or when the sender domain is newly seen.

Use secure email gateway or Microsoft Defender for Office 365 message and attachment telemetry (the “encrypted” or “unscannable” verdict is the key field), and URL-click logs if the gateway rewrites links. Sweep 90 days back, to cover the August-to-October rise in activity. Allowlist regular partners who send encrypted documents by sender domain and authentication result, not by subject. Quarantining all encrypted attachments is a valid hardening step for some organizations but blocks legitimate legal and HR traffic for others; a tagged warning banner plus this alert is the usual middle ground. Hashes are of limited value here because each lure is generated per campaign. A hit by itself is a phishing triage case: pull the message, check who opened the attachment, and feed those users into the correlation lead below. The rule generalizes to many credential and malware campaigns that use encrypted attachments to evade scanning.

Hunt Lead Level: 2 (Pro)

ATT&CK: Initial Access → T1566.001 (Phishing: Spearphishing Attachment) (mapping per source article).

Sources: “SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises”, ANY.RUN, Oct. 27, 2026, https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/ (source article); AlienVault OTX file analysis for 9aa0b879…c268, retrieved Oct. 29, 2026, https://otx.alienvault.com/indicator/file/9aa0b87974b9b4cd42603833b7ad44257578467d279b315a071108a5ed02c268 (additional source; file type, MD5 and SHA-1)

Device Code Sign-Ins Outside an Approved Population

The kit’s payoff is a device code authorization: the victim enters the attacker’s code at Microsoft’s real device login (login.microsoft[.]com/device or login.microsoftonline[.]com/common/oauth2/deviceauth), completes their normal sign-in and MFA, and Microsoft issues access and refresh tokens to the session the kit has been polling. Nothing about the sign-in page is fake, so the evidence is in Entra ID, not on the phishing site. ANY.RUN does not publish the client or application IDs the kit requests, so the detection cannot anchor on a specific app. The detection logic is an Entra ID sign-in rule for interactive sign-ins whose authentication protocol is the device code flow, from users who are not on an allowlist of accounts that legitimately use it (meeting-room and shared devices, administrators using command-line tools), with higher severity when the sign-in IP, ASN or country differs from the user’s recent history, or when the subsequent non-interactive token use comes from a hosting provider such as DigitalOcean.

Use Entra ID sign-in logs (interactive and non-interactive), streamed to a SIEM; the device code flow is recorded in the sign-in’s authentication protocol field. Sweep back to June 23, 2026. Build the allowlist from 30 days of history before alerting, keyed on user and application, not on display names. The strongest control is a Conditional Access policy that blocks the device code flow for everyone outside that allowlist, which ANY.RUN also recommends; resetting the password after the fact is the wrong first response, because the stolen refresh token stays valid until sessions are revoked. Any device code sign-in by a user who was not expecting one should be treated as account compromise: revoke sessions, remove any devices or app consents added since, review inbox rules and mailbox access, and check the user’s mail for the lure. This lead catches every device code phishing kit, not just SkyW4lker, including the earlier KeyStealth kit.

Hunt Lead Level: 2 (Pro)

ATT&CK: Credential Access → T1528 (Steal Application Access Token) (mapping per source article).

Sources: “SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises”, ANY.RUN, Oct. 27, 2026, https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/ (source article)

Lure-to-Poll-to-Device-Code Sign-In Correlation

The full SkyW4lker sequence leaves a trail across three log sources for one person: an inbound external message with an encrypted attachment and the password in the body; within minutes to hours, that user’s browser reaching a kit page (a landing token path, the CAPTCHA endpoints, then a run of session_public.php?action=poll requests every few seconds); and, while the polling is under way, an Entra ID device code sign-in for the same identity, followed by non-interactive token use from an IP that does not belong to the user. ANY.RUN’s own guidance is to correlate phishing indicators with sign-in events and review Microsoft 365 activity after compromise. The detection logic is a stateful correlation keyed on the user: mail event, then proxy event to a host first seen in the last 30 days (or matching the kit paths), then a device code sign-in, all within a window of about one hour, with the alert carrying the message ID, the host and the sign-in correlation ID for the responder.

This needs identity resolution across mail, proxy and Entra ID logs (mapping the proxy user or device to the Entra user principal name), a SIEM that supports sequence or join rules, and a first-seen-domain baseline. Run it continuously and back-test over 90 days before enabling alerts. Tune by narrowing the mail stage to encrypted attachments or new sender domains rather than all external mail, and allowlist nothing at the sign-in stage, since a device code sign-in in this sequence is the compromise itself. A correlated hit is an incident, not a tuning case: revoke sessions and refresh tokens, remove rogue devices, and search for the same lure across other mailboxes. Because the logic keys on the flow rather than on kit paths, it continues to work when the operators change domains, tokens or file names, and it applies to any device code phishing kit.

Hunt Lead Level: 3 (Elite)

ATT&CK: Execution → T1204.001 (User Execution: Malicious Link); Credential Access → T1528 (Steal Application Access Token) (mapping per source article).

Sources: “SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises”, ANY.RUN, Oct. 27, 2026, https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/ (source article)

Hash Appendix

Spearphishing attachment

The SHA-256 comes from the source article, which publishes no other hashes. The MD5 and SHA-1 were sourced via AlienVault OTX, whose analysis of the same file identifies it as an encrypted PDF 1.5; VirusTotal was not queried.

MD5s

f70f61ea93f6a63bb8a5432640d95aeb  # password-protected PDF lure -> email attachment (sourced via OTX)

SHA1s

3bda958ca9ddae49c9eb6e2dd4cae18ae0fe24c3  # password-protected PDF lure -> email attachment (sourced via OTX)

SHA256s

9aa0b87974b9b4cd42603833b7ad44257578467d279b315a071108a5ed02c268  # password-protected PDF lure -> email attachment, password in message body

References Appendix

• “SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises”, ANY.RUN (ShiFu), Oct. 27, 2026, https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/ (source article; kit analysis, IOCs, ATT&CK mapping, TI Lookup query)
• AlienVault OTX file analysis, 9aa0b87974b9b4cd42603833b7ad44257578467d279b315a071108a5ed02c268, retrieved Oct. 29, 2026, https://otx.alienvault.com/indicator/file/9aa0b87974b9b4cd42603833b7ad44257578467d279b315a071108a5ed02c268 (file type, MD5 and SHA-1 of the example attachment)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/