SkyW4lker Is Here: The Phishing Kit That Doesn't Need Your Password — Or Your MFA Code
By UVIDSTUDIO · October 28, 2026 · 8 min read · Cybersecurity
A threat-intelligence firm detailed a phishing campaign called SkyW4lker that skips stealing your password entirely — it talks an employee into approving a real Microsoft sign-in the attacker started, handing over working Microsoft 365 access without a fake login page in sight. Here's what researchers found on October 28, 2026, and what to check this week if your business runs on Microsoft 365.
Most phishing advice still boils down to "don't type your password into a fake login page." That advice doesn't help against the campaign a threat-intelligence firm detailed this week, because the victim never types a password anywhere fake — they approve a real Microsoft login, on a real Microsoft screen, that the attacker happens to have started first. Researchers at ANY.RUN published findings on October 28, 2026 describing SkyW4lker, a phishing kit built around a Microsoft sign-in feature called device-code authentication. If your business runs on Microsoft 365 — and most small businesses and nonprofits do, in whole or in part — this is worth five minutes before it's your inbox in next month's report.
What happened
ANY.RUN's report, covered the same day by The Hacker News, traces a campaign running since at least June 2026 that concentrates heavily on American organizations in manufacturing, technology, and healthcare. The firm counted 618 sandbox analyses of the campaign's phishing kit between June and October 21, 2026 — a measure of how often security teams and automated tools submitted samples for analysis, not a confirmed victim count — with 46% of those submissions originating in the United States.
The lure is unremarkable on purpose: a password-protected document arrives by email, dressed up as a contract or a service proposal — the kind of attachment an office worker opens without a second thought, partly because a password on the file feels like a security measure rather than a red flag. Opening it routes the victim through a page hosted on Google's own infrastructure, then into what is, by every visible signal, a genuine Microsoft sign-in screen — because it is one. The twist is that the attacker started that sign-in first, using Microsoft's "device code" flow, a legitimate feature built for logging into devices without a keyboard, like a smart-TV app or a conference-room console. The victim is simply asked to type in a short code and approve a login that looks routine. In doing so, they approve the attacker's session, not their own — and Microsoft hands the attacker a valid access token for that employee's Microsoft 365 account, no stolen password involved anywhere in the chain.
Researchers disagree on exactly how to describe what this does to multi-factor authentication. One framing holds that the kit exploits an employee's authorization decision rather than technically defeating MFA's cryptography; a plain-language breakdown of how device-code phishing works in general is worth a read if you want the mechanics (CybersecurityNews). Either description lands in the same place for a small business: an employee who did everything the training covered — strong password, MFA turned on, no suspicious "verify your account" prompt — can still hand an attacker a working session. ANY.RUN also assesses, with high confidence, that SkyW4lker shares a developer with Gabagool, an existing credential-phishing kit, though it stops short of confirming the two are run by the same operators (Mallory).
Why it matters for small businesses
The reason this one deserves attention beyond the usual phishing roundup is that it's built to slip past exactly the defenses most small businesses have already put in place. We've written before about the verification habits that stop AI-polished phishing — call back on a known number, don't trust urgency — but SkyW4lker doesn't ask for a wire transfer or a password. It asks for thirty seconds of routine-looking cooperation with what looks exactly like a Microsoft login, which is precisely the kind of request that doesn't trip the mental alarm a "CEO fraud" email does. And because Microsoft 365 is the backbone of email, file storage, and Teams for a huge share of small offices, a single approved device code can open calendars, SharePoint files, and the inbox itself to someone who was never in the building and never had a password to steal.
This also fits a pattern worth naming on its own: attackers increasingly go after the session, not the password. We covered the same shift with infostealer malware that copies session cookies rather than credentials, and SkyW4lker is the phishing-side version of the identical idea — get a live, already-authenticated token, and the password and the MFA prompt both become irrelevant. If you're not sure which of your accounts a stolen or consented-away session could reach, that's exactly the gap a cyber footprint audit is built to map before an attacker does.
What to do this week
None of this requires new software, just a few minutes of checking and one conversation with your team.
- Tell your staff, in plain terms, what a device-code prompt looks like — a short code to type on a Microsoft page and an "approve this sign-in" button — and that they should never approve one they didn't personally start, even if the surrounding email looks like a normal business document.
- If you're on Microsoft 365, ask whoever manages it (in-house IT or your MSP) whether device-code authentication can be restricted or disabled for accounts that don't genuinely need it — most employees never sign into a keyboard-less device and have no reason to use this flow at all.
- Review your Microsoft Entra ID (Azure AD) sign-in logs for device-code sign-ins your IT provider doesn't recognize as legitimate; an unexpected one is close to a smoking gun.
- Make password-protected attachments a reason to slow down, not speed up — the lock icon on a file is not evidence it's safe, and that instinct is exactly what this campaign is built to exploit.
- Revisit your MFA setup — not to abandon it, since it still stops the vast majority of ordinary credential attacks, but to understand that no MFA method defends against an employee being talked into approving the attacker's own login.
- If you suspect an account was compromised this way, revoke its active sessions and re-issue its tokens, not just reset the password — a device-code attack doesn't touch the password at all, so changing it alone leaves the attacker's session untouched.
SkyW4lker will fade from the headlines in a few weeks, the way every named campaign does, but the technique behind it — attack the login flow itself, not the credentials — isn't going anywhere. If you're a small business or nonprofit in Jersey City, Hudson County, or anywhere in the NYC metro running Microsoft 365 and you're not sure who's watching your sign-in logs for exactly this kind of approval, that's squarely the gap our cybersecurity team closes — training, access reviews, and monitoring built in as a normal part of how your business runs, not a scramble after an inbox has already been read by someone who was never supposed to see it.