A phishing operation called Skyw4lker has been targeting American organizations in manufacturing, technology, and healthcare by exploiting legitimate Microsoft authentication systems rather than traditional credential theft, according to an analysis published by ANY.RUN. The campaign uses business-themed documents, Google-hosted pages, and Microsoft's device code authorization flows to compromise corporate accounts. The approach allows attackers to obtain access tokens without reproducing fake login pages, making the intrusion harder to spot through standard identity monitoring.

The scale of phishing threats facing U.S. organizations has grown substantially. The FBI's Internet Crime Complaint Center logged 193,407 phishing and spoofing complaints in 2024, ranking it among the most frequently reported internet crime categories. In 2025, the FBI recorded over 1 million internet crime complaints and $20.9 billion in reported losses, with losses climbing 26% compared to the prior year. Device code phishing represents an evolution in tactics as attackers adapt to organizations that have invested heavily in multi-factor authentication and identity security.

The Skyw4lker campaign begins with a password-protected document disguised as a contract or service proposal, designed to appear credible in workplaces where employees regularly exchange vendor agreements and procurement files. Victims are redirected from the document to a page hosted on sites.google.com, which then leads into a Microsoft authentication flow. The attacker initiates a legitimate device authorization request and convinces the victim to complete it, allowing the attacker to obtain Microsoft 365 access tokens. ANY.RUN's analysis identified obfuscated JavaScript and a PHP backend that creates victim sessions, collects IP addresses and geolocation data, and polls the backend while waiting for authentication to finish. The report notes that static inspection of the original document may reveal the starting URL, but cannot fully explain what occurs once the victim interacts with the page.

The report emphasizes that device code phishing campaigns require security teams to trace authentication flows and supporting infrastructure, not just identify the initial lure. Because the authentication itself can be legitimate, organizations may see a valid authentication event without immediately recognizing the malicious context behind it. Establishing what happened demands connecting the document, web activity, authentication flow, and associated infrastructure through behavioral analysis rather than relying on identity telemetry alone. For U.S. healthcare, manufacturing, and technology organizations, a compromised Microsoft 365 account can expose sensitive communications, intellectual property, operational information, and regulated data. The report concludes that modern phishing defense requires visibility beyond the initial lure or login page, combining interactive sandboxing, threat intelligence, and contextual investigation to move faster from suspicious artifact to actionable intelligence. Organizations that can turn findings from one investigation into intelligence searchable across wider environments gain the ability to identify related activity before it escalates into a larger incident. The difference between stopping phishing at the door and discovering it weeks later often lies in whether security operations can reuse existing threat knowledge instead of reconstructing it for every new alert.