American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed

Skyw4lker targets US manufacturing, technology, and healthcare organizations through device code phishing. Password-protected contracts or proposals send victims through Google Sites into legitimate Microsoft authentication flows. Completing attacker-initiated authorization gives attackers Microsoft 365 tokens. ANY. RUN identified obfuscated JavaScript and a PHP backend tracking victim sessions, IP addresses, and geolocation, and the backend repeatedly polls for authentication completion.