ANY.RUN's analysis of the Skyw4lker kit (covered Oct 28) describes device-code phishing aimed mainly at US manufacturing, technology and healthcare. Lure: password-protected document framed as a contract or proposal → page on sites.google.com → victim completes a legitimate Microsoft device-authorization flow the attacker started, handing the attacker tokens without a fake password form.

Detections / response:

• Alert on device-code / device-authorization grant activity, especially from unfamiliar apps or outside change windows (see also blocking device code flow where the business allows it).
• Correlate recent OAuth/device-code sign-ins with inbound password-protected Office docs and Google Sites redirects.
• Revoke refresh tokens for affected accounts, require re-auth, and review mailbox rules / app consents afterward.