---
title: Hunt: Skyw4lker device-code phishing hits US manufacturing, tech and healthcare with password-protected "contract" docs → sites.google.com → real Microsoft device-code login | ctxsec
url: https://ctxsec.com/items/hunt-skyw4lker-device-code-phishing-us-orgs
description: ""
status: "vendor research (ANY.RUN analysis via The Hacker News, Oct 28); IOCs in sandbox task; campaign scale beyond the write-up not independently counted"
published: 2026-10-28
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-skyw4lker-device-code-phishing-us-orgs.md)

vendor research (ANY.RUN analysis via The Hacker News, Oct 28); IOCs in sandbox task; campaign scale beyond the write-up not independently counted

2026-10-28

### Hunt: Skyw4lker device-code phishing hits US manufacturing, tech and healthcare with password-protected "contract" docs → sites.google.com → real Microsoft device-code login

ANY.RUN's analysis of the **Skyw4lker** kit (covered Oct 28) describes device-code phishing aimed mainly at US manufacturing, technology and healthcare. Lure: password-protected document framed as a contract or proposal → page on `sites.google.com` → victim completes a **legitimate** Microsoft device-authorization flow the attacker started, handing the attacker tokens without a fake password form.

**Detections / response:**

- Alert on device-code / device-authorization grant activity, especially from unfamiliar apps or outside change windows (see also [blocking device code flow](/items/tip-block-device-code-flow) where the business allows it).
- Correlate recent OAuth/device-code sign-ins with inbound password-protected Office docs and Google Sites redirects.
- Revoke refresh tokens for affected accounts, require re-auth, and review mailbox rules / app consents afterward.

Sources: [ANY.RUN / The Hacker News: Skyw4lker device code phishing campaign (Oct 28)](https://thehackernews.com/2026/10/american-organizations-under-attack.html) · [ANY.RUN public task example cited in coverage](https://app.any.run/tasks/371eeef8-8ac2-4421-a25b-b648821375ef/)