SkyW4lker Phishing Kit: Microsoft 365 Threat to US Firms

SkyW4lker is a phishing kit active since June 2026 that targets Microsoft 365 authentication by exploiting OAuth 2.0 device-code flows to bypass MFA. It uses password-protected email attachments leading victims through CAPTCHA pages to malicious sites requesting device codes. The kit primarily targets US firms, especially in technology, manufacturing, and government sectors, and shares infrastructure with the Gabagool phishing kit.

• Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 AccountsMalware2026-10-20
• Automated Subversion and Attempted Takeover of AI Pentesting HarnessesMalware2026-10-27
• DarkCore: A Data-Theft RAT With a Session-Hijacking BrowserMalware2026-10-27
• M365 Token Spray and Replay Campaign Compromises Business Email AccountsCampaign2026-10-22
• LiteLLM supply chain compromiseCampaign2026-10-22