SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises
SkyW4lker (SkyW4lker x365 Sentinel) is an active device-code phishing kit targeting Microsoft 365 users in the United States, Europe, and other regions. By abusing Microsoft’s legitimate authentication process, the kit can give attackers access to corporate accounts without stealing passwords or bypassing MFA. This puts business emails, sensitive documents, and other Microsoft 365 resources at risk of unauthorized access.
The ANY.RUN team identified 618 sandbox analyses related to SkyW4lker between June and October 21, 2026, with 46% of submissions coming from the United States. Activity increased from 20 analyses in June to 200 in September, highlighting the growing exposure of organizations relying on Microsoft 365.
Key Takeaways
- SkyW4lker is distributed through phishing emails with a password-protected malicious attachment; the password is provided in the email body. After a chain of decoy pages, the victim reaches a page that asks for a Microsoft device code.
- The kit consists of a...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
