ANY.RUN analyzed a device code phishing campaign called Skyw4lker, which primarily targets U.S. organizations, including manufacturing, technology, and healthcare sectors.
The vulnerability or weakness
Skyw4lker exploits legitimate cloud services and Microsoft authentication flows, tricking victims into completing a device authorization flow, thus obtaining authentication tokens.
Earlier attacks and coverage
Business impact
This campaign can compromise corporate accounts, leading to potential data breaches and unauthorized access to sensitive information, impacting operations and potentially leading to financial losses.
Industries affected
Manufacturing, technology, and healthcare sectors are the primary targets.
Users affected
Employees and contractors who handle business documents and engage with cloud services and Microsoft authentication flows are at risk.
