Phishing Kit SkyW4lker Abuses Microsoft Sign-In to Hijack Business Accounts

The Hacker News reports that SkyW4lker is an active phishing kit that misuses Microsoft's legitimate device-code authentication process. Instead of stealing passwords or bypassing multi-factor authentication, it relies on the victim entering a device code on a genuine Microsoft page, which can give attackers unauthorised access to a corporate account. ANY.RUN researchers identified 618 related sandbox analyses between June and October 21, 2026, with 46% coming from the US.

The attack begins with phishing emails disguised as contracts, invoices or business proposals. Victims are sent through CAPTCHA checks and trusted platforms before landing on Microsoft's real authentication page. Because the final step happens on a trusted site, the scam can be harder for staff to spot.

Researchers also used a new ANY.RUN feature, Related Threat Context, to link one SkyW4lker investigation to earlier sandbox sessions and wider threat intelligence. This uncovered further malicious infrastructure and technical links to another phishing kit, Gabagool. The related activity targeted technology, government, education, consulting and healthcare organisations, with submissions from the US, Latin America and Europe. Security teams can use the associated URLs to enrich detection systems and hunt for connected threats. Note that this is only the opening of a longer article covering five threats, and this summary addresses only the first.