{
  "id": 19641834,
  "title": "SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises",
  "url": "https://urgent.news/2026/11/12/skyw4lker-exposed-a-growing-microsoft-365-phishing-threat-to-american",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-12T10:37:38.000Z",
  "source": {
    "name": "HackerNoon",
    "slug": "hackernoon",
    "url": "https://hackernoon.com/skyw4lker-exposed-a-growing-microsoft-365-phishing-threat-to-american-enterprises?source=rss"
  },
  "original_language": "en",
  "account": "SkyW4lker is a malicious device-code phishing kit targeting Microsoft 365 users across the United States, Europe, and other regions. This threat exploits Microsoft's authentication process to gain unauthorized access to corporate accounts without stealing passwords or bypassing multi-factor authentication (MFA). In June through October 2026, 618 sandbox analyses related to SkyW4lker were identified, with 46% of submissions originating from the United States. Activity surged from 20 analyses in June to 200 in September, indicating the expanding impact of this phishing threat on organizations relying on Microsoft 365. Distributed through phishing emails containing password-protected malicious attachments, SkyW4lker directs victims through a series of deceptive pages to prompt them for a Microsoft device code. The kit comprises a PHP backend and obfuscated JavaScript, facilitating geolocation tracking and periodic checks to verify successful authentication. With 618 analyses recorded over the past six months, the attack primarily targets the technology, manufacturing, and government sectors, predominantly affecting organizations in the United States, India, Canada, and the United Kingdom. SkyW4lker shares JavaScript modules, landing-URL format, and hosting infrastructure with Gabagool, a credential phishing kit active since April 2026, suggesting a common origin. By leveraging routine business workflows—such as contracts, invoices, and service proposals—SkyW4lker disguises malicious requests within familiar platforms and legitimate Microsoft authentication pages, complicating detection efforts. To mitigate the risks associated with SkyW4lker, enterprises must address identity security gaps, enhance detection capabilities, and mitigate broader organizational exposure. This incident underscores the critical need for robust security measures to safeguard critical business systems and protect employee identities from unauthorized access.",
  "summary": "Discover how SkyW4lker abuses Microsoft 365 device-code authentication and how ANY.RUN traced 618 analyses and uncovered links to Gabagool.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}