Skyw4lker Device Code Phishing Campaign Exploits Legitimate Authentication Mechanisms Against U.S. Organizations

ANY.RUN researchers uncovered a phishing campaign named Skyw4lker targeting primarily U.S. organizations. The campaign abuses legitimate cloud services…

Strengthen user security awareness regarding unusual device authentication requests. Implement conditional access policies and monitoring for atypical authentication activities in cloud platforms. Review authentication logs for unauthorized device code flows.