Search — “Skyw4lker”

ANY.RUN describes Skyw4lker, a device code phishing campaign primarily targeting US organizations in manufacturing, technology and healthcare. Victims receive a password-protected business document that leads through a sites[.]google[.]com page into a Microsoft authentication flow where the attacker-initiated device authorization is completed, yielding Microsoft 365 tokens. The source reports the attack chain but does not confirm specific victim compromises; hunters should look for device code authentication events and Google Sites-hosted redirects to Microsoft login.