Device Code Phishing: Why MFA Won't Stop Skyw4lker

1 day ago

8 min read

By Yonatan Hoorizadeh, CISSP, CISM, CRISC, AAISM

Published By: Purple Shield Security

Published: October 28, 2026

Last updated: October 28, 2026

Device code phishing tricks an employee into approving an attacker's sign-in on Microsoft's real login page. The employee passes MFA, and the attacker receives Microsoft 365 access tokens. Skyw4lker, a campaign ANY.RUN exposed on October 27, 2026, uses this method against U.S. manufacturing, technology, and healthcare firms. Blocking unneeded device code sign-ins closes most of the gap.

Most mid-market companies rolled out multi-factor authentication (MFA) to stop Microsoft 365 account takeover. Skyw4lker gets in after MFA has done its job, because the employee completes every prompt for the attacker.

What is device code phishing?

Device code phishing is an attack that abuses the OAuth 2.0 Device Authorization Grant, a Microsoft sign-in method built for devices without keyboards, such as conference-room displays and smart TVs. The attacker starts a sign-in, then persuades a victim to enter the attacker's code at Microsoft's genuine device login page. Once the victim signs in and completes MFA, Microsoft issues tokens to the attacker's session.

The legitimate device code flow works like this: a device shows a short code, the user types that code at microsoft.com/devicelogin on a phone or laptop, and the device is signed in. Nothing in the flow is broken. Device code phishing swaps the user's device for one the attacker controls.

Device code phishing is not new. Microsoft and Volexity documented the technique in February 2025, and during 2026 phishing-as-a-service kits such as EvilTokens and Kali365 turned it into an off-the-shelf product that any criminal can rent. The FBI has warned about Kali365 specifically.

How does the Skyw4lker campaign work?

Skyw4lker sends a password-protected document dressed up as a contract or service proposal. The document links to a page hosted on Google Sites, which passes the victim through CAPTCHA checks and into a real Microsoft authentication page. When the victim enters the code and approves the sign-in, the attacker's backend collects the resulting Microsoft 365 tokens, according to ANY.RUN's analysis.

The password on the Skyw4lker attachment is deliberate. Many email security tools cannot open an encrypted file to inspect the link inside it, so a password-protected lure often reaches the inbox without being flagged. The password also makes the document feel more official to the recipient.

ANY.RUN found obfuscated JavaScript and a PHP backend behind the Skyw4lker phishing page. The code creates a session for each victim, records the victim's IP address and location, and polls repeatedly until the Microsoft sign-in is complete. Mallory's tracking of the research counts 173 hosting domains tied to the operation.

ANY.RUN also assessed with high confidence that Skyw4lker shares a developer with Gabagool, a credential-phishing kit first seen in April 2026. ANY.RUN has not confirmed that the same criminals operate both kits, but the overlap suggests one platform offering two attack modes: password theft and device code theft.

Why doesn't MFA stop device code phishing?

MFA doesn't stop device code phishing because the victim completes MFA on purpose. The attacker never needs the password or the one-time code. The employee signs in at Microsoft's real page, satisfies every MFA prompt, and approves a session that belongs to the attacker. From Microsoft's point of view, a legitimate user performed a legitimate sign-in.

ANY.RUN's write-up in The Hacker News makes the point directly: the sign-in itself can be genuine, and "the deception is in convincing the victim to complete an authentication request." That is why device code phishing is hard to spot in identity logs. A security team sees a valid sign-in event with nothing in it that shows the malicious context.

Push notifications, text message codes, and authenticator apps all fail the same way against device code phishing. Phishing-resistant methods such as FIDO2 security keys and passkeys defeat fake login pages, but Skyw4lker doesn't use a fake page. The control that matters is whether your Microsoft 365 tenant allows device code sign-ins at all.

Who is Skyw4lker targeting, and how fast is it growing?

Skyw4lker mainly targets U.S. organizations in manufacturing, technology, and healthcare. ANY.RUN first observed the kit on June 23, 2026, and had linked 618 sandbox analyses to it by October 21, with about 46% submitted from the United States. Monthly submissions grew from about 20 in June to 200 in September, a tenfold increase in three months.

Sandbox submissions measure how often security teams analyzed a Skyw4lker sample, not how many accounts were compromised. Even so, a tenfold rise in analysts encountering the kit is a reliable sign that the campaign is reaching more inboxes.

The financial backdrop explains why attackers keep investing in phishing. The FBI's Internet Crime Complaint Center (IC3) recorded more than 1 million complaints and $20.9 billion in reported losses in 2025, a 26% increase over 2024, according to figures cited in The Hacker News coverage of Skyw4lker.

The contract lure chooses its own victims. The employees most likely to open a vendor agreement are in procurement, finance, legal, and operations, and those mailboxes hold invoices, payment instructions, and regulated data. A compromised accounts-payable mailbox is the starting point for most business email compromise fraud.

What does most coverage of device code phishing miss?

Most coverage of device code phishing stops at the initial sign-in and skips what happens after. A password reset does not reliably end the attack, because the attacker holds tokens rather than the password. ANY.RUN has reported that EvilTokens, a related device code kit, harvests refresh tokens that give attackers 90 days of persistent access. Containment means revoking sessions and tokens, then hunting for persistence.

Persistence after a device code compromise usually shows up in four places in Microsoft 365: new devices registered in Microsoft Entra ID, new mailbox forwarding or inbox rules, new OAuth application consents, and changes to the user's MFA methods. ANY.RUN observed the Forg365 kit registering devices in Entra ID under an identifiable name prefix, which is the kind of artifact incident responders look for.

Cyber insurance applications typically ask a yes-or-no question about whether MFA is enforced. A company can answer yes honestly and still be fully exposed to device code phishing. The more useful question for leadership is which sign-in methods the Microsoft 365 tenant still allows, and who approved each exception. Microsoft 365 is the SaaS security problem most mid-market firms already own, and most have never reviewed it at that level.

Healthcare organizations face a regulatory clock on top of the technical one. Under the HIPAA Breach Notification Rule, unauthorized access to a mailbox holding protected health information (PHI) is presumed to be a breach unless a documented risk assessment shows a low probability that the PHI was compromised. Notification to affected individuals is due without unreasonable delay and no later than 60 days after discovery.

What should a business do about device code phishing this week?

Most businesses should block device code sign-ins for everyone except the specific devices and accounts that need them. In Microsoft Entra ID, a Conditional Access policy can restrict the device code authentication flow, and Microsoft recommends blocking the flow wherever possible. After that, review recent device code sign-ins, warn staff about unexpected code prompts, and update the incident plan to cover token revocation.

Inventory who actually uses device code sign-in. Microsoft Teams Rooms and other shared meeting displays, some smart TVs, and command-line admin tools such as Azure CLI are the usual legitimate users.
Create a Conditional Access policy that blocks the device code flow, with a named exception group for the devices and accounts that need it. Run the policy in report-only mode for a week first if you are unsure what it will affect.
Check your licensing. Conditional Access requires Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium and in E3 and E5 plans. Tenants on Business Basic or Business Standard need an upgrade or add-on to get it.
Pull the last 90 days of Microsoft Entra ID sign-in logs and filter on the authentication protocol "Device code." Any hit from a user who doesn't operate meeting-room hardware deserves a closer look.
Give finance, procurement, legal, and operations staff one simple rule: opening a document never requires typing a code at microsoft.com/devicelogin.
Update the incident response runbook so a suspected account takeover triggers session and refresh-token revocation, not only a password reset.

How would a fractional CISO triage a suspected device code compromise?

A fractional CISO (a part-time Chief Information Security Officer, also called a virtual CISO or vCISO) treats a confirmed device code approval as an active Microsoft 365 account takeover. The first 24 hours focus on containment and scope. The next 48 hours decide whether regulators, customers, or the cyber insurer need to be notified, and on what timeline.

Hours 0 to 24: contain and preserve

In the first day after a suspected device code compromise, revoke the user's sessions and refresh tokens, and disable the account if the attacker may still be active. Export the relevant Microsoft Entra ID sign-in logs and Microsoft 365 audit logs before retention limits erase them. Search every mailbox for the same Skyw4lker-style lure to find other employees who received it or approved a code.

Hours 24 to 72: scope and decide

In days two and three, use the Microsoft 365 audit logs to establish which emails and files the attacker could have accessed. That scope drives every notification decision: HIPAA for healthcare data, state breach notification laws for personal information, and contractual notice obligations to customers. Most cyber insurance policies also expect prompt notice of a suspected incident, so the carrier call belongs in this window.

After containment, the device code question becomes a documented risk decision with a named owner rather than a default setting nobody chose. Purple Shield's fractional CISO services cover exactly this kind of work: deciding which sign-in methods the business actually needs, writing the exception policy, and running a tabletop exercise that tests the response before a real Skyw4lker email arrives.

Frequently asked questions

Does resetting the password remove an attacker who used device code phishing?

Not reliably. In a device code attack, the attacker holds Microsoft 365 tokens rather than the password, so a reset alone may leave the attacker's session working. Revoke the user's sessions and refresh tokens in Microsoft Entra ID, then check for new device registrations, mailbox forwarding rules, and OAuth app consents the attacker may have added.

Will blocking device code flow break anything in Microsoft 365?

Blocking device code flow can break sign-in for devices that depend on it, most often Microsoft Teams Rooms displays, some shared screens, and command-line tools that administrators run with device code login. Put those accounts or devices in a Conditional Access exception group before enforcing the block. Running the policy in report-only mode for a week shows exactly who would be affected.

How can I tell if someone in my company approved a malicious device code?

Filter Microsoft Entra ID sign-in logs by the authentication protocol "Device code" and look for users who don't operate meeting-room hardware. Pay close attention to device code sign-ins that occur minutes after the user received a password-protected contract or proposal by email. Unfamiliar IP addresses or locations on those sign-ins justify a full investigation.

Is a device code phishing compromise a HIPAA breach?

A device code phishing compromise can be a HIPAA breach. If the compromised Microsoft 365 account held or could reach protected health information, HIPAA presumes a breach unless a documented four-factor risk assessment shows a low probability that the PHI was compromised. Covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovery.

If you aren't sure whether your Microsoft 365 tenant allows device code sign-ins, or who decided that it should, that's worth answering this week. Purple Shield's cloud security consulting includes Microsoft 365 and Entra ID configuration reviews, and our incident response services help when a suspicious sign-in has already been approved. Get in touch and we'll help you close the gap.