SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises

A phishing kit named SkyW4lker targets Microsoft 365 users globally by abusing legitimate authentication processes, allowing attackers access without stealing passwords or bypassing Multi-Factor Authentication (MFA). The kit is distributed via phishing emails containing password-protected attachments. Victims are lured through a chain of decoy pages leading to a request for a Microsoft device code. Technically, the kit employs a PHP backend and obfuscated JavaScript for IP geolocation and checking victim authentication status.
The investigation revealed that SkyW4lker shares components with another credential phishing kit named Gabagool, suggesting they originate from the same developer and utilize shared modules like clientgeo.js and endpoint.js across their infrastructure. Attackers leverage familiar business workflows, such as contracts and invoices, to deliver malicious links, making the activity appear as routine business communication.
The investigation highlights the need for organizations to reassess identity security beyond standard phishing defenses, focusing on closing authentication policy gaps and strengthening detection across email and identity systems. The connection between these kits demonstrates a shared methodology in exploiting trust within established platforms like Microsoft.

* SkyW4lker targets Microsoft 365 users in the United States, Europe, and other regions.
* The kit abuses Microsoft’s legitimate authentication process to gain access without stealing passwords or bypassing MFA.
* The kit is distributed through phishing emails with password-protected attachments.
* Victims are directed through decoy pages to a page requesting a Microsoft device code.
* The kit features a PHP backend and obfuscated JavaScript for IP-based geolocation and periodic polling of the backend.
* The attack chain involves sending an email attachment, redirecting through lure pages (e.g., Google Maps, Zoom), and finally prompting for a device code on a Microsoft authentication page.
* The technical components include JavaScript modules like clientgeo.js, urlhelper.js, and endpoint.js.
* SkyW4lker shares JavaScript modules and hosting infrastructure with Gabagool, suggesting a shared developer.
* The kit exploits business workflows using contracts, invoices, and service proposals as phishing lures.
* SkyW4lker activity was observed between June and October 21, 2026, across 618 sandbox analyses.
* The United States accounts for 47% of SkyW4lker-related sandbox submissions.
* The attack employs techniques such as impersonation (imitating business correspondence) and obfuscation (JavaScript).
* Indicators include URL patterns like /sessionpublic.php?action=start/poll and specific JavaScript file paths.

The existence of SkyW4lker, intricately linked to Gabagool through shared code and infrastructure, suggests a systemic issue where attackers repurpose established technical methodologies across different attack modes—credential harvesting via one route (Gabagool's accounts.php) and device-code phishing via another (SkyW4lker's sessionpublic.php). This indicates a platform or framework is being utilized to maximize the exploitation of legitimate Microsoft authentication flows, moving beyond simple credential theft into exploiting the complexity of modern MFA environments.
The connection between real-world domain registration patterns and the shared hosting infrastructure used by both kits points toward an operational layer that abstracts the specific attack vector, allowing developers to reuse infrastructure for different objectives. This level of cross-platform development suggests a maturity in the threat actor's operational planning, where the focus shifts from unique delivery mechanisms to maximizing reach via reusable operational tools.
The emphasis placed on ANY.RUN’s Related Threat Context successfully accelerating the investigation demonstrates that understanding the interconnectedness of threat infrastructure is as crucial as identifying individual Indicators of Compromise. This implies that future defense strategies must move beyond perimeter controls and reactive filtering toward holistic identity risk modeling, focusing specifically on anomalous sequences of authentication events rather than just blocking known malicious links. How do we build proactive controls that monitor the *sequence* of legitimate-looking actions taken by users across trusted services?