SkyW4lker Phishing Campaign Expands, Threatening US Enterprises with Microsoft 365 Account Takeovers

A phishing kit called SkyW4lker (also branded SkyW4lker x365 Sentinel) is quietly taking over Microsoft 365 accounts without ever stealing a password. Instead of cracking logins or breaking MFA, it tricks employees into approving a legitimate Microsoft device-code sign-in, handing attackers a valid session to corporate mailboxes, documents, and connected apps. The kit has been active since June 2026 and is accelerating fast. Researchers at ANY.RUN tracked 618 sandbox analyses tied to SkyW4lker between June and October 21, 2026, with monthly submissions climbing from 20 in June to 200 in September. Nearly half (46–47%) of those submissions came from the United States, more than twice the share of any other country. For US enterprises running on Microsoft 365, that makes SkyW4lker one of the more pressing identity threats of the quarter. This article breaks down how the kit works, who it targets, how it was traced back to a sibling phishing platform, and what SOC teams and security leaders can do about it. No password theft, no MFA bypass needed. SkyW4lker abuses Microsoft’s OAuth 2.0 device-code flow. The victim types a code into a real Microsoft login page; the attacker gets the token. Delivery looks like routine business. Password-protected PDF,…