Episode Details

This story was originally published on HackerNoon at: https://hackernoon.com/skyw4lker-exposed-a-growing-microsoft-365-phishing-threat-to-american-enterprises.
Discover how SkyW4lker abuses Microsoft 365 device-code authentication and how ANY.RUN traced 618 analyses and uncovered links to Gabagool.
Check more stories related to undefined at: https://hackernoon.com/c/undefined. You can also check exclusive content about #skyw4lker-phishing-kit, #microsoft-entra-id-security, #phishing-threat-intelligence, #gabagool-phishing-kit, #skyw4lker-x365-sentinel, #oauth-device-code-attack, #microsoft-365-code-phishing, #good-company, and more.

This story was written by: @anyrun. Learn more about this writer by checking @anyrun's about page, and for more stories, please visit hackernoon.com.

SkyW4lker is a Microsoft 365 phishing kit that abuses OAuth device-code authentication to compromise corporate accounts without directly stealing passwords or bypassing MFA. ANY.RUN identified 618 related sandbox analyses between June and October 21, 2026, with activity rising from 20 submissions in June to 200 in September. Its Related Threat Context capability helped analysts connect URLs, JavaScript modules, and infrastructure to previous investigations, uncovering similarities with Gabagool. The findings suggest both kits were built by the same developer, although the available evidence does not establish whether they share one operator. The research also outlines the attack chain, technical indicators, and identity-security measures organizations can use to detect and reduce exposure.