Executive Summary
SkyW4lker (also known as SkyW4lker x365 Sentinel) is an emergent phishing kit that specializes in abusing Microsoft's legitimate OAuth 2.0 device-code authentication flow. Observed significantly since June 2026, the kit allows attackers to gain unauthorized access to Microsoft 365 resources without the need to steal traditional passwords or perform complex MFA bypasses, as it relies on the victim authorizing a device code on a legitimate Microsoft page.
Technical analysis reveals a sophisticated multi-stage attack involving password-protected lures (PDF, DOCX, XLSX) and obfuscated JavaScript modules. Research strongly suggests SkyW4lker is developed by the same author as the Gabagool phishing kit, sharing infrastructure and modular code. The campaign has seen a 10x increase in activity between June and September 2026, with 46% of attacks targeting organizations in the United States.
This threat is high-impact due to its ability to bypass standard MFA and impersonate routine business workflows like contract approvals and invoices. Sectors including technology, manufacturing, and government are currently at the highest risk. Organizations should urgently review Entra ID policies regarding device-code authentication to mitigate this exposure.