US manufacturers, technology firms and healthcare providers are the targets of a credential-harvesting operation that never asks for a credential. ANY.RUN, whose sandbox team named the kit Skyw4lker, says the attackers instead borrow Microsoft’s own sign-in machinery.
The first message looks like a vendor agreement. Recipients get a password-protected document dressed as a contract or statement of work, unremarkable in any procurement-heavy business. Opening it pushes the user to a page hosted on Google sites and then into a genuine Microsoft authentication prompt.
That prompt is the attack. The operator has already requested a device authorization code; the victim only has to confirm it. Once confirmed, the resulting Microsoft 365 tokens belong to the attacker, and no fake login page was ever involved.
Why identity logs look clean
Defenders reviewing sign-in telemetry see a successful, legitimate authentication against the corporate tenant. Nothing about the event is malformed, which is exactly why the technique keeps working against organizations that invested heavily in multifactor authentication.
Behind the lure, ANY.RUN found obfuscated JavaScript and a PHP backend that registers a visitor session, logs IP address and geolocation, and polls until the authorization completes. Static inspection of the document reveals the opening URL and nothing else.
What to check this week
Hunt for device-code sign-ins that end in mailbox access from an address the user has never used, then pivot to the mail rule and OAuth grant changes that usually follow. Microsoft documents the flow’s legitimate use, so the alert has to key on anomaly rather than on the mechanism itself.
At the helpdesk, the bigger lever is process. Teach staff that nobody legitimate asks them to enter a short code to read a document. The Federal Bureau of Investigation logged 193,407 phishing and spoofing complaints in 2024 alone.
