Skyw4lker leans on device codes to phish U.S. orgs

Phishing doesn’t always chase passwords anymore. A new campaign dubbed “Skyw4lker” is going after American organizations by riding device-based sign-in flows instead, according to ANY.RUN’s analysis published by The Hacker News.

ANY.RUN’s write‑up, as covered by The Hacker News, says Skyw4lker primarily targets U.S. organizations and abuses legitimate cloud services, authentication mechanisms, and trusted business workflows to access corporate accounts. The pitch to victims can look routine because it co‑opts normal sign‑in steps rather than demanding credentials outright.

The researchers emphasize that this approach leaves fewer obvious signs behind, making traditional phishing telltales—like sketchy domains or password prompts—less reliable. That matters for security teams that still bias detections toward payloads, strange URLs, or credential posts.

The report calls Skyw4lker a “device code phishing” operation, pointing to attacks that exploit device‑based login flows to capture access without stealing usernames and passwords. Those flows are designed to be user‑friendly, which also makes them tempting to abuse when controls are loose.

ANY.RUN’s analysis, cited by The Hacker News, frames the core risk plainly: modern phishing can compromise businesses without relying on traditional credential theft. That pattern aligns with other recent intrusions where attackers prized tokens and sessions over raw passwords.

What happened

The Hacker News reports that ANY.RUN observed Skyw4lker leveraging legitimate cloud services to reach corporate accounts, primarily in the U.S. The campaign focuses on device‑based authentication flows and trusted workflows, aiming to blend into business as usual while moving past legacy login traps.

Because device code flows are expected in many environments, the social engineering looks like a helpful nudge rather than a hard phish, the report suggests. That lowers suspicion and raises the odds that a user completes the sign‑in on the attacker’s terms.

The analysis underscores that these techniques reduce obvious traces. Instead of harvesting credentials at a fake page, the attacker piggybacks on approved steps, leaving security teams to spot the misuse in identity and cloud logs rather than the mailbox alone.

This isn’t an isolated drift. Our reporting on AI‑made login clones grabbing MFA and sessions detailed how adversary‑in‑the‑middle (AitM) kits and polished clones go after tokens that outlive a single prompt. Skyw4lker’s device‑code angle targets the same prize—persistent access—via a different on‑ramp.

We also covered Huntress’ findings that a Microsoft 365 token‑replay spree touched 79 tenants from mid‑July to late September in 2026, bypassing re‑prompts for MFA (token replay hit 79 orgs). That campaign did not rely on password theft either; like Skyw4lker, it chased session artifacts that keep doors open.

Large‑scale abuse of legitimate cloud plumbing isn’t new. A recent industry takedown linked infrastructure to more than a billion malicious messages and showed how phishing services turn cloud tools into delivery and hosting layers (phishing takedown hit cloud accounts). Skyw4lker’s approach fits cleanly into that playbook.

The background

Device‑code logins exist to make sign‑in easier on devices with limited input, but the same convenience can blur user judgment when prompts feel routine. That’s the tradeoff Skyw4lker exploits, according to The Hacker News’ summary of ANY.RUN’s analysis.

Attackers have been chipping away at authentication edges from multiple angles this year. We reported on a ConnectWise Cloud Backup compromise that let unknown actors reach 173 Microsoft 365 tenants via an app credential, prompting the vendor to pull the service and disable seven identities (ConnectWise pulled Cloud Backup). That was a supply‑chain foothold, not a mailbox lure, but it ended in the same place: account access.

We also covered a Google‑focused AitM campaign against Taiwan research affiliates that used believable invites to steal logins and MFA (fake invites, real theft). It shows how normal‑looking workflows—the meeting ask, the shared doc, the RSVP—double as lures when the backend is hostile.

Beyond specific campaigns, defenders are shifting tooling to read intent across channels. Proofpoint’s integration with Microsoft’s ICES means detections from one stack can flow into Microsoft Defender for a single view (one console, more signal). That consolidation helps when the giveaway isn’t a payload but an identity blip buried in logs.

Security teams sorting signal from noise increasingly need their mailbox telemetry sitting next to identity and cloud app events. As The Hacker News notes via ANY.RUN, Skyw4lker’s strength is hiding inside “trusted business workflows,” which forces detections to pivot from content to context.

What people are saying

“Modern phishing campaigns can compromise American businesses without relying on traditional credential theft,” The Hacker News writes, summarizing ANY.RUN’s analysis. That line captures why this class of attack confounds rules tuned to catch old‑school password grabs.

The report also highlights that attackers can “abuse legitimate cloud services, authentication mechanisms, and trusted business workflows,” which puts cloud providers and enterprise IdPs in the response loop. The mitigations live as much in tenant policy as in the inbox.

Vendors have been responding by fusing data sources and tightening defaults. The Proofpoint‑Microsoft tie‑up promises fewer consoles and faster investigations by pushing third‑party detections into Microsoft’s native view—useful when an incident crosses email, identity, and browser layers in hours, not days (proofpoint plugs into Microsoft).

Incident responders we’ve covered around recent token‑centric intrusions stressed watching for suspicious session reuse, consent grants, and logins that complete via unexpected flows. That maps directly to Skyw4lker’s device‑code vector, where the “weirdness” shows up after the click, not before it.

What happens next

Expect more phish that look like IT hygiene and fewer that look like scams. As ANY.RUN’s analysis via The Hacker News suggests, the lift now is correlating mailbox context with identity events: device code prompts at odd hours, new app grants, or tokens hopping across ASNs.

Email and identity teams will need joint playbooks that treat device‑code flows as sensitive, not background noise. That includes restricting device logins where possible, reviewing enterprise app consent regularly, and alerting on token refresh from unfamiliar networks.

For day‑to‑day defense, tune security gateways and cloud-native detections to flag unusual reauthentication nudges and out‑of‑band prompts. Tie those alerts to rapid investigations in your central console so a quiet phish doesn’t turn into lateral movement.

If you’re ramping up coverage across phishing and identity, our security hub tracks how attackers increasingly bypass passwords to live off the land—in cloud services you already trust.