Device Code Phishing Campaign Skyw4lker Sidesteps Passwords to Hijack Microsoft Accounts

Researchers at ANY.RUN have analysed Skyw4lker, a device code phishing campaign that mainly targets organisations in the United States, with a focus on manufacturing, technology and healthcare. Rather than building a fake login page to harvest passwords, the attackers start a genuine device authorisation process and persuade the victim to complete it. The resulting authentication tokens can then give access to whatever the compromised account can reach. Because legitimate cloud services and sign-in flows are involved, the attack can leave fewer obvious warning signs.

The campaign begins with a lure that looks like normal business correspondence. Victims receive a password-protected document presented as a contract or service proposal, a believable scenario for workplaces that regularly swap vendor agreements, procurement papers and statements of work. From the document, the victim is directed to a page hosted on Google Sites, which eventually leads into a Microsoft authentication flow.

The researchers note that attackers are adapting to organisations that have invested in identity security and multi-factor authentication (MFA). This source excerpt covers only the opening of the research, so further technical detail is not included here. For context, the FBI's Internet Crime Complaint Center recorded 193,407 phishing and spoofing complaints in 2024, and more than 1 million internet crime complaints in 2025, with reported losses of $20.9 billion.