SkyW4lker Phishing Kit: Microsoft 365 Threat to US Firms

SkyW4lker is a phishing kit that targets Microsoft 365 users, primarily in the United States and Europe. It abuses Microsoft's device-code authentication flow to gain access to corporate accounts without stealing passwords or bypassing MFA. The kit uses password-protected email attachments containing links that lead victims through CAPTCHA challenges to Microsoft's legitimate authentication system. Activity increased notably between June and October 2026, with the US accounting for nearly half of the observed submissions. The kit shares infrastructure and code with the Gabagool phishing kit, indicating a common threat actor.

• SkyW4lker Phishing Kit: Microsoft 365 Threat to US FirmsMalware2026-10-27
• Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 AccountsMalware2026-10-20
• MadApe: The Code That Opens the DoorCampaign2026-10-29
• M365 Token Spray and Replay Campaign Compromises Business Email AccountsCampaign2026-10-22
• Active Cloud Data Theft and Extortion Campaign Targeting Microsoft 365 and SaaS PlatformsCampaign2026-09-10