Skyw4lker Device Code Phishing Campaign Targets U.S. Organizations

According to analysis by cybersecurity firm ANY.RUN, a phishing campaign identified as Skyw4lker has been actively targeting organizations across the United States. The attack does not rely on traditional credential theft but instead abuses Microsoft's device code authentication flow. Attackers send phishing messages designed to trick users into approving device code prompts that appear as part of normal Microsoft authentication workflows. Because these prompts leverage legitimate cloud services and authentication mechanisms, they can bypass conventional phishing detection and multi-factor authentication safeguards. The campaign primarily targets U.S. organizations and exploits the trust inherent in Microsoft's cloud authentication infrastructure, allowing unauthorized access to corporate accounts with fewer obvious signs of intrusion. ANY.RUN's report highlights that the technique exploits the device code flow, which is designed for authenticating devices without browsers, by social engineering users into approving prompts that grant attacker access. The firm notes that specific victim counts and detailed attacker infrastructure remain unconfirmed, but the campaign characteristics align with known device code phishing techniques. Microsoft has been notified, and security recommendations include user education on recognizing device code prompts, implementation of conditional access policies to restrict device code authentication, and monitoring for unusual approval patterns.