SkyW4lker Device-Code Phishing Kit Steals Microsoft 365 Tokens Through Microsoft's Real Login Page — 618 Samples, 173 Domains and a Tenfold Rise Since June

High · 2026-11-07 · By H.A

SkyW4lker Device-Code Phishing Kit Steals Microsoft 365 Tokens Through Microsoft's Real Login Page — 618 Samples, 173 Domains and a Tenfold Rise Since June

The SkyW4lker phishing kit uses password-protected lures and CAPTCHA gates to trick users into entering device codes on Microsoft's genuine sign-in page, handing attackers Microsoft 365 tokens that bypass MFA.

Overview

SkyW4lker — also branded "SkyW4lker x365 Sentinel" — is a device-code phishing kit that steals Microsoft 365 access without ever touching a password. Victims are walked into typing a code on Microsoft's genuine device login page; the sign-in, including any MFA prompt, completes normally, and the OAuth tokens go to the attacker.

Researchers who tracked the kit between 23 June and 21 October 2026 linked 618 sandbox analyses to it. Monthly volume rose from about 20 in June to about 200 in September. Roughly 46–47% of submissions came from the United States, more than twice any other country, followed by India, Canada and the UK. In the U.S., technology, manufacturing and government organisations were most affected. The infrastructure spans 173 phishing domains and 92 backend IP addresses, 50 of them on DigitalOcean.

The Campaign

The attack chain:

  1. A lure email arrives with a password-protected PDF, DOCX, XLSX or EML attachment, the password given in the email body. Encryption stops gateways from scanning the contents.
  2. Themes are business-routine: contracts, invoices, approved statements, Fedwire payment notices and service proposals.
  3. The attachment leads — sometimes via a decoy page on a trusted platform such as Google Sites, Google Maps, Miro, Zoom, Smartsheet or Axure Cloud, or intermediate storage on Cloudflare R2, Linode or Mintlify — to a CAPTCHA gate (Cloudflare Turnstile or a self-hosted widget) that blocks automated scanners.
  4. A branded page displays a Microsoft device code and tells the victim to enter it at Microsoft's real device-login page.
  5. The victim signs in and approves MFA. In Entra ID this appears as a legitimate device-code authentication; the kit's backend, which has been polling, receives the token.

Because the authentication happens on Microsoft's own domain, users who were trained to "check the URL" see nothing wrong.

Timeline

Tradecraft

Indicators of Compromise

URL patterns:

//it[A-Za-z0-9]{32}us          (landing token, Aug–Oct 2026)
//zt[A-Za-z0-9]{32}op          (older landing token, Jun–Sep 2026)
/assets/php/endpoints/session_public.php?action=start
/assets/php/endpoints/session_public.php?action=poll&session_id=
/assets/php/endpoints/confirm_visit.php
/assets/js/client_geo.js  /assets/js/endpoint.js  /assets/js/url_helper.js
/assets/private_captcha/public/widget.js?v=4

Sample domains: 5200m[.]com, torvion[.]life, ghethim[.]com, goldcreekconcrete[.]com, goldcreekconcrete[.]org, flow505.mooo[.]com, bigbrain.chickenkiller[.]com, off365acess.jumpingcrab[.]com

IP addresses: 172.86.85[.]51, 162.243.64[.]121, 67.205.154[.]32

Sample lure SHA-256: 9aa0b87974b9b4cd42603833b7ad44257578467d279b315a071108a5ed02c268

Detection

SigninLogs
| where AuthenticationProtocol == "deviceCode"
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, Location, ResultType

Recommended Actions

  1. Block device-code flow with an Entra Conditional Access "authentication flows" policy, allowing it only for named users or devices that genuinely need it (conference-room hardware, some CLI tools).
  2. Block or quarantine the published domains and IPs at the mail gateway and web proxy.
  3. Treat emails carrying encrypted attachments with the password in the body as high-risk, especially for finance teams.
  4. Prepare a token-compromise runbook: revoke refresh tokens and sessions, reset credentials, review OAuth app consents, inbox rules, SharePoint/OneDrive access and outbound mail.
  5. Teach users one simple rule: never type a code into a Microsoft login page because a document or email told you to.

Analyst Assessment

Device-code phishing bypasses the controls most organisations rely on — password managers, MFA prompts and URL checks — because the victim really is on Microsoft's site. SkyW4lker packages that technique as a maintained product with evasion, profiling and an operator panel, and its tenfold growth over the summer shows demand. We rate it High. The good news is that the fix is largely a configuration change: most tenants can switch device-code flow off for nearly everyone today.

REEF SENTINEL