SkyW4lker

Key Takeaways

• Device-Code Phishing: SkyW4lker abuses Microsoft's OAuth device authorization flow to compromise accounts without necessarily stealing passwords.
• Business-Themed Lures: Password-protected documents disguised as invoices, contracts, and commercial offers lead victims into the phishing workflow.
• CAPTCHA and Redirects: Verification challenges and legitimate services help disguise phishing infrastructure and redirect visitors.
• Growing Activity: ANY.RUN recorded 618 related sandbox analyses between June and October 2026.
• Developer Connection: Shared components link SkyW4lker to Gabagool, with researchers assessing a high-confidence common developer.
• Detection: Suspicious device-code authentication, unusual OAuth activity, and related browser or email telemetry can help identify attacks.
• ANY.RUN’s Interactive Sandbox analysis helps investigate SkyW4lker's phishing workflow, including attachment delivery, browser redirects, CAPTCHA challenges, authentication requests, and backend communication.

What is SkyW4lker?

SkyW4lker, also known as SkyW4lker x365 Sentinel, is a device-code phishing kit targeting Microsoft 365 users. It abuses legitimate OAuth authentication to authorize attacker-controlled sessions.

Unlike conventional phishing, which captures credentials through fake login forms, SkyW4lker directs victims to Microsoft's genuine authentication page. The malicious element is the attacker-initiated authentication request and the device code supplied to the victim.

Its infrastructure combines PHP backend endpoints, obfuscated JavaScript, CAPTCHA verification, visitor geolocation, session monitoring, and an operator administration panel.

ANY.RUN identified 618 related sandbox analyses between June and October 2026, with activity across multiple regions and sectors.

The investigation also revealed technical similarities with Gabagool, a credential phishing kit first observed in April 2026. Gabagool focuses on credential harvesting, while SkyW4lker abuses device-code authentication. Researchers assess with high confidence that both kits share a developer.

How SkyW4lker Can Affect Businesses and Organizations

SkyW4lker can compromise Microsoft 365 identities and expose organizational resources, including:

• Corporate Mailboxes: Confidential correspondence, customer communications, and attachments.
• Business Communications: Opportunities for employee impersonation, internal phishing, and fraudulent payment requests.
• Cloud Documents: Contracts, financial records, and other sensitive business information.
• Organizational Access: Unauthorized sessions that may persist until compromised tokens and access mechanisms are revoked. The actual impact depends on the compromised account's permissions, the resources accessible through the obtained tokens, and the actions performed after authentication.

Victimology: Which Organizations May Be at Risk?

ANY.RUN observed activity involving technology, manufacturing, government, consulting, and other sectors.

The United States accounted for approximately 47% of related sandbox submissions, followed by activity associated with India, Canada, the United Kingdom, and other countries.

These figures represent analyzed activity, not confirmed compromised organizations. Any organization relying on Microsoft 365 may be exposed, depending on its identity controls and phishing defenses.

How Does SkyW4lker Function?

Observing a SkyW4lker sample inside ANY.RUN’s Interactive Sandbox reveals a phishing workflow that combines password-protected document delivery, CAPTCHA verification, intermediary redirects, and Microsoft device-code authentication.

Stage 1: Password-Protected Documents

The attack begins with a phishing email containing a password-protected PDF, DOCX, XLSX, or another document. The password is included in the message body, complicating automated inspection.

Lures typically imitate contracts, invoices, commercial offers, financial statements, or confidential business documents.

The document contains a link leading to the phishing infrastructure.

Stage 2: CAPTCHA and Redirects

Following the link may present a CAPTCHA challenge, including Cloudflare Turnstile or a self-hosted implementation.

Some campaigns also use intermediary pages hosted on legitimate services such as Google Sites, Miro, or Zoom. These redirects lead visitors toward the final authentication page while making the original link less suspicious.

Stage 3: Device-Code Authentication

The phishing page instructs victims to visit Microsoft's legitimate device-authentication website and enter an attacker-generated code.

The code is associated with an authentication request initiated by the attacker. If the victim completes the authentication, the attacker may obtain authorization for the associated Microsoft 365 account.

This technique abuses OAuth 2.0 device authorization and can succeed without directly collecting the victim's password.

Stage 4: Backend Communication and Session Monitoring

SkyW4lker uses PHP and JavaScript components to register visitors and monitor authentication progress.

Researchers identified the endpoint: /assets/php/endpoints/session_public.php

Its primary actions include:

• action=start — registers a visitor and initializes a session.

• action=poll — periodically checks authentication status.

The initialization process can collect IP-related and geolocation information and return a session identifier. Subsequent polling requests track whether authentication has completed.

The client_geo.js module gathers visitor location information through services such as ip-api.com, ipapi.co, and ipwho.is, or through the backend endpoint /assets/php/endpoints/client_geo.php.

Another module, endpoint.js, monitors authentication-related fields, including email, password-related information, browser details, and MFA status. It communicates with: /assets/php/endpoints/accounts.php

These components support visitor profiling, authentication monitoring, and account-related data handling.

Stage 5: Administration Panel

The administration interface is located at: /admin/index.php

Analysis of its resources indicates functionality for:

• Telegram-based MFA
• Visitor statistics and geolocation
• Server management
• Phishing-link generation
• Live visit notifications

The panel allows operators to manage phishing infrastructure and monitor activity.

Stage 6: Infrastructure Correlation

SkyW4lker shares several technical components with Gabagool, including:

• client_geo.js
• url_helper.js
• endpoint.js
• /assets/php/endpoints/confirm_visit.php
• Self-hosted CAPTCHA functionality

These similarities support a high-confidence assessment of a shared developer. However, the available evidence does not establish whether all campaigns are operated by one individual or multiple customers using the same platform.

SkyW4lker Detection Indicators

Detection should combine email, browser, network, and identity telemetry rather than rely on individual filenames or domains.

Email and Browser

• Password-protected attachments disguised as business documents.
• Unexpected links in invoices, contracts, and commercial offers.
• CAPTCHA challenges followed by suspicious redirects.
• Device-code instructions appearing after document access.
• JavaScript associated with phishing-session initialization or polling.

Network and Web Requests

• /assets/php/endpoints/session_public.php
• /assets/php/endpoints/accounts.php
• /assets/php/endpoints/confirm_visit.php
• /assets/js/client_geo.js
• /assets/js/endpoint.js
• /assets/js/url_helper.js
• Requests containing action=start or action=poll.

These paths may change across deployments and should be treated as behavioral indicators rather than definitive signatures.

Identity and Authentication

• Unexpected Microsoft device-code authentication.
• Authentication approvals users do not recognize.
• Unusual Microsoft Entra ID sign-ins following suspicious email interactions.
• Unexpected OAuth authorization activity or token-related access.
• Unfamiliar mailbox access, forwarding rules, or account changes.

Correlating suspicious email delivery with subsequent browser and identity activity provides stronger detection than isolated indicators.

Threat Intelligence and Investigation

SkyW4lker's use of legitimate services and multiple infrastructure components can make individual phishing URLs insufficient for understanding an incident.

Investigators should correlate:

• Suspicious domains and URLs
• Email attachments and redirect chains
• JavaScript resources and backend endpoints
• Device-code authentication events
• Related phishing infrastructure
• Previous sandbox analyses

ANY.RUN’s Threat Intelligence Lookup can help correlate suspicious artifacts with historical activity and related infrastructure.

threatName:skyw4lker

To strengthen defenses against SkyW4lker, security teams can integrate Threat Intelligence Feeds into their existing security stack. TI Feeds continuously deliver fresh malicious indicators from real-world threat analyses, helping SOC and MSSP teams detect phishing infrastructure, identify suspicious authentication activity, and keep detection rules and monitoring workflows aligned with emerging SkyW4lker threats.

The /session_public.php endpoint proved particularly useful in identifying related analyses and expanding the investigation.

ANY.RUN’s Interactive Sandbox can reveal browser redirects, JavaScript execution, HTTP requests, and backend communication in an isolated environment.

Together, sandbox analysis and threat intelligence help investigators reconstruct the phishing workflow and identify related activity beyond a single malicious URL.

SkyW4lker Incident Response

When SkyW4lker-related activity is suspected, investigate both the phishing interaction and potential identity compromise.

Recommended actions:

• Secure affected identities: Revoke compromised sessions and refresh tokens where supported, reset credentials when appropriate, and investigate suspicious sign-ins.
• Investigate device-code activity: Determine whether users approved authentication requests they did not initiate.
• Review OAuth activity: Examine authorization grants, application permissions, and suspicious authentication events.
• Inspect mailboxes: Look for unauthorized access, forwarding rules, suspicious messages, and account changes.
• Assess business fraud: Investigate invoice manipulation, supplier changes, payment requests, and impersonation.
• Preserve evidence: Retain phishing emails, attachments, browser records, URLs, and authentication logs.
• Search for related activity: Identify similar emails, suspicious sessions, and matching infrastructure across the environment.
• Strengthen prevention: Review device-code authentication restrictions, phishing defenses, and identity monitoring.

Microsoft Entra Conditional Access can help restrict unnecessary device-code authentication. Organizations should also validate that compromised sessions and unauthorized access have been fully terminated before closing an incident.

Conclusion

SkyW4lker demonstrates how attackers can compromise Microsoft 365 accounts by abusing legitimate authentication workflows rather than relying solely on password theft or counterfeit login pages.

Its combination of protected business documents, CAPTCHA challenges, redirects, and device-code authentication bcreates a phishing workflow that requires coordinated email, browser, and identity monitoring to investigate effectively.

The connection with Gabagool further illustrates how shared phishing components can support multiple account-compromise techniques.

Correlating suspicious email interactions with authentication events and threat intelligence is essential to detecting SkyW4lker activity and limiting account takeover.

Frequently Asked Questions: SkyW4lker

1. What is SkyW4lker?

SkyW4lker, also known as SkyW4lker x365 Sentinel, is a Microsoft 365 device-code phishing kit that abuses OAuth authentication to compromise organizational accounts.

2. How does SkyW4lker compromise accounts?

Victims open password-protected business documents, follow phishing links, pass CAPTCHA challenges, and enter attacker-generated device codes on Microsoft's legitimate authentication page.

3. Does SkyW4lker steal passwords?

Its primary technique is device-code authentication abuse, but its JavaScript and backend also support authentication monitoring and account-related data collection.

4. Is SkyW4lker related to Gabagool?

Yes. Researchers identified shared JavaScript modules, URL patterns, CAPTCHA components, and infrastructure. They assess with high confidence that both kits share a developer.

5. How can organizations detect SkyW4lker?

Monitor suspicious device-code authentication, unexpected OAuth activity, password-protected phishing attachments, unusual browser redirects, and related backend requests.

6. How should organizations respond to SkyW4lker incidents?

Investigate authentication approvals, revoke compromised sessions and tokens where supported, secure affected accounts, review mailbox activity, preserve evidence, and search for related phishing campaigns.

7. Can SkyW4lker bypass MFA?

SkyW4lker can abuse authentication workflows that involve MFA. If a victim approves an attacker-initiated authentication request, the attacker may obtain an authorized session despite MFA being enabled.

8. How can sandboxing and threat intelligence help investigate SkyW4lker?

Interactive sandboxing reveals phishing redirects and backend behavior, while threat intelligence correlates URLs, domains, and infrastructure with previous analyses.