SkyW4lker is an active phishing kit targeting Microsoft 365 users in the United States, Europe, and other regions. It is distributed through emails containing password-protected attachments, with the password provided in the message body. The campaign primarily affects organizations in technology, manufacturing, and government sectors, with a significant concentration of activity in the United States. By exploiting legitimate authentication processes, the kit allows attackers to access corporate accounts without stealing passwords or bypassing multi-factor authentication. This method puts business emails, sensitive documents, and other resources at risk of unauthorized access, creating a direct threat to enterprise identity security and data integrity.
The attack mechanism begins with a phishing email containing a password-protected document, which directs the victim to a CAPTCHA page or a lure page on a legitimate service. The victim is then directed to a phishing page that requests a device code for Microsoft authentication. The kit uses a PHP backend and obfuscated JavaScript to maintain contact with the victim. It determines the victim's location using IP-based geolocation and polls the backend periodically to check if authentication is complete. The scripts log the victim's email, password, browser, and multi-factor authentication status. The kit shares technical components and hosting infrastructure with the Gabagool credential phishing kit, indicating they were built by the same developer. This shared platform supports both device-code phishing and credential harvesting, allowing attackers to compromise accounts through multiple methods using identical infrastructure and code modules.[/subscribe_to_unlock_form]
SkyW4lker is an active phishing kit targeting Microsoft 365 users in the United States, Europe, and other regions. It is distributed through emails containing password-protected attachments, with the password provided in the message body. The campaign primarily affects organizations in technology, manufacturing, and government sectors, with a significant concentration of activity in the United States. By exploiting legitimate authentication processes, the kit allows attackers to access corporate accounts without stealing passwords or bypassing multi-factor authentication. This method puts business emails, sensitive documents, and other resources at risk of unauthorized access, creating a direct threat to enterprise identity security and data integrity.
The attack mechanism begins with a phishing email containing a password-protected document, which directs the victim to a CAPTCHA page or a lure page on a legitimate service. The victim is then directed to a phishing page that requests a device code for Microsoft authentication. The kit uses a PHP backend and obfuscated JavaScript to maintain contact with the victim. It determines the victim's location using IP-based geolocation and polls the backend periodically to check if authentication is complete. The scripts log the victim's email, password, browser, and multi-factor authentication status. The kit shares technical components and hosting infrastructure with the Gabagool credential phishing kit, indicating they were built by the same developer. This shared platform supports both device-code phishing and credential harvesting, allowing attackers to compromise accounts through multiple methods using identical infrastructure and code modules.[emaillocker id="1283"]
The campaign has grown significantly, with sandbox analyses increasing from twenty in June to two hundred in September. The United States accounts for nearly half of all related submissions, highlighting the primary target region. The connection to Gabagool suggests a single developer is supporting both attack modes, providing attackers with versatile tools to compromise business accounts. The use of legitimate authentication flows and trusted platforms makes malicious activity difficult to distinguish from normal operations. Organizations should review authentication policies to restrict unnecessary device-code access and strengthen detection across email and identity systems. Connecting suspicious attachments with unusual authentication events helps identify potential compromises before attackers expand their access within the environment.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Reconnaissance | T1590.005 | Gather Victim Network Information | IP Addresses |
| Resource Development | T1583.001 | Acquire Infrastructure | Domains |
| Resource Development | T1583.003 | Acquire Infrastructure | Virtual Private Server |
| Resource Development | T1608.005 | Stage Capabilities | Link Target |
| Initial Access | T1566.001 | Phishing | Spearphishing Attachment |
| Initial Access | T1566.002 | Phishing | Spearphishing Link |
| Execution | T1204.001 | User Execution | Malicious Link |
| Defense Evasion | T1027 | Obfuscated Files or Information | - |
| Defense Evasion | T1497 | Virtualization/Sandbox Evasion | - |
| Defense Evasion | T1656 | Impersonation | - |
| Credential Access | T1528 | Steal Application Access Token | - |
| Collection | T1056.003 | Input Capture | Web Portal Capture |
| Objective | Behavior ID | Behavior |
|---|---|---|
| Anti-Behavioral Analysis | B0007 | Sandbox Detection |
| Anti-Static Analysis | E1027 | Obfuscated Files or Information |
| Collection | E1056 | Input Capture |
| Communication Micro-objective | C0002 | HTTP Communication |
| Data Micro-objective | C0019 | Check String |
The following reports contain further technical details:
[/emaillocker]