ANY.RUN says its SkyW4lker device code phishing kit appears in 618 sandbox analyses, and counts no victims
ANY.RUN's report of 27 October 2026 counts 618 sandbox analyses of a Microsoft 365 device code phishing kit, 46% to 47% from the United States. It prints no victim count, and ANY.RUN sells the sandbox those analyses came from.
By Parminder Kumar Sharma · · 19 min read
618 sandbox analyses in 120 days: what ANY.RUN counted for SkyW4lker, and what it did not
ANY.RUN's report on the SkyW4lker phishing kit, dated 27 October 2026, counts 618 sandbox analyses between 23 June and 21 October 2026. Derived: that is 120 days, so about 5 analyses a day. ANY.RUN says 46% of them were submitted from the United States; its own chart on the same page says 47%. Every one of these figures counts files and links that somebody ran through ANY.RUN's sandbox. The report prints no count of victims, mailboxes, accounts taken over or tokens issued, and it names no organisation as compromised.
The Hacker News published a summary on 28 October 2026 under a headline that, per a search listing, speaks of American organizations under attack by a Skyw4lker campaign. That page answered with a Cloudflare challenge and was not read, so this briefing rests on the ANY.RUN post itself and on Microsoft's documentation, and uses the headline only as a pointer. The two wordings differ in a way that matters. ANY.RUN calls SkyW4lker a phishing kit: software that anyone with access can point at any target. It does not describe a single campaign with a known victim list, and it says outright that its data cannot tell one operator from several customers of the same platform.
What the kit does is plain enough, and it is not a flaw in Microsoft 365. A phishing page shows the victim a device code and tells them to type it into Microsoft's own sign in page. When the victim does, and completes MFA as they normally would, Microsoft's genuine service, as Microsoft describes the flow, issues tokens to whoever started the request. The control that fits is a Conditional Access policy that blocks the device code flow. Microsoft says it recommends blocking that flow wherever possible, and ANY.RUN's advice for security leaders is the same in one sentence.
How this was read. The ANY.RUN post was fetched in full at about 18:45 UTC on Wednesday 28 October 2026 (robots.txt first, an honest user agent, no challenge), saved as HTML and as text, and its figures were saved as images. The Microsoft pages were fetched the same way. The ANY.RUN post and its screenshots were re read at 18:51 UTC. An earlier briefing on this site covers a different device code kit, EvilTokens, and is not repeated here.
What SkyW4lker is, and who gave it that name
The ANY.RUN post describes SkyW4lker, also written SkyW4lker x365 Sentinel, as an active device code phishing kit aimed at Microsoft 365 users in the United States, Europe and other regions. Its overview table lists the name under the heading "Operator / brand", gives the activity window as June 2026 to now, and gives the motivation as "Possible financial". The kit is a PHP backend with obfuscated JavaScript. ANY.RUN counts 520 of its 618 analyses as carrying an obfuscated JavaScript tag (derived: 84.1%).
Who named it? The report does not say. The best evidence is in its own screenshot of the kit's operator login panel, which is titled with the name and the words operator authentication. That points to the kit's author or operator, not to ANY.RUN, as the source of the brand. It is an inference from the figure below, not a statement in the text. The report adds that the panel's style sheet suggests Telegram based MFA for the operator, a victim statistics dashboard, server management, link generation and live notifications about visits to phishing links.
The name is itself a small lesson. A panel that calls itself a Sentinel, for authorised personnel only, is a criminal tool dressed in a defender's vocabulary. The label tells a reader nothing about what the software does, and neither does the label "device code" until the reader knows Microsoft's flow.
How the device code flow is abused, in Microsoft's terms and ANY.RUN's
Microsoft's documentation says the device authorization grant lets users sign in on devices with limited input, such as a smart TV, an IoT device or a printer. The device shows a code and the user finishes the sign in in a browser on another device. The page also gives the code a life: "From the moment the request is sent, the user has 15 minutes to sign in." While the user signs in, the client polls Microsoft's token endpoint with the device code, and on success receives access and refresh tokens.
Microsoft Threat Intelligence described the abuse in its Storm-2372 post: the attacker generates a genuine device code request and tricks the target into entering it into a genuine Microsoft sign in page, after which the attacker captures the access and refresh tokens. That post is from 13 February 2025 and is about a different, suspected state aligned cluster, so it is used here for the mechanism and the defences only. Microsoft's page adds that the technique "could enable persistent access as long as the tokens remain valid".
ANY.RUN describes three stages. First, an email with a password protected attachment, a PDF, DOCX or XLSX, with the password in the email body. Typical subjects involve commercial offers, contracts, invoices or confidential documents. Second, the document links to a CAPTCHA page, and some variants add a lure page on a legitimate service such as Miro, Google Sites or Zoom. Third, the victim reaches a page that tells them to enter a device code on Microsoft's legitimate authentication page. The report does not say why the attachment is password protected. A reasonable inference, labelled as one, is that a locked file cannot be opened by a mail gateway, but the report does not test that.
On that landing page the code is shown by the attacker's page, and the victim is told to copy it and paste it into a pop up. The page also does the kit's housekeeping. Its scripts send the visitor's IP address and location to the backend with action=start and receive a session identifier, then call action=poll every few seconds to ask whether the victim has finished. Derived from the timestamps in the report's own screenshot of one sandbox run: ten requests between 58.62 and 106.39 seconds, nine gaps, an average of 5.3 seconds.
Not printed by ANY.RUN: how the backend obtains each device code from Microsoft, which application identifier and scopes it requests, how long a token is used for, and what an operator does with a token afterwards. Those would take the story from the phishing page to the intrusion, and the report stays on the page.
The Gabagool link: one developer, two kinds of phishing, an unknown number of operators
ANY.RUN says SkyW4lker shares JavaScript modules, a landing URL format and part of its hosting with Gabagool, a credential phishing kit it dates from April 2026. Gabagool's first sighting is 23 April and SkyW4lker's is 23 June (derived: 61 days apart, which the report rounds to two months). ANY.RUN's wording: "We assess with high confidence that both kits were built by the same developer." It regards them as two attack modes of one platform, Gabagool harvesting logins through accounts.php and SkyW4lker abusing the device code flow through session_public.php.
The shared hosts are the most concrete part of the evidence: both kits appear in the same directories on the same domains, and some sandbox sessions tagged Gabagool load the kit from directories named skywalker or skyw4lker. The report then draws the limit itself: the identical directories "may also point to a common operator", but the data "does not allow us to distinguish one operator from several customers of the same platform". A platform sold to customers would explain all of it, and so would one operator. That is why this briefing says kit and not campaign.
Stated and not stated: what the record establishes
What the ANY.RUN report of 27 October 2026 prints, and what it does not. Read from the post on 28 October 2026.
| Topic | Stated by ANY.RUN | Not stated |
|---|---|---|
| Scale | 618 sandbox analyses from 23 June to 21 October 2026; 20 in June and 200 in September | How many were real attacks and not researcher or test submissions; how many reached a recipient |
| Victims | Nothing, beyond the country and sector of whoever submitted a sample | Any victim count, any compromised account, any token issued, any success rate, any named organisation |
| Geography | 46% of submissions from the United States in the text, 47% in the chart; India, Canada and the United Kingdom next | How the country is decided; whether a submission from the United States means a victim in the United States |
| Sectors | Submitters mainly in technology, manufacturing and government | That those sectors were targeted or breached; a sector split of recipients |
| Actor | High confidence that one developer built SkyW4lker and Gabagool | Who that is, whether there is one operator or several customers, any nation state or group name |
| Impact | Business email, documents and other Microsoft 365 resources are put at risk | What any operator did with an account; any follow on activity, fraud or data theft |
| Mechanism | Device code phishing page, polling backend, geolocation, CAPTCHA, admin panel | How device codes are obtained from Microsoft, and the tokens or scopes requested |
Submissions by country as drawn in the ANY.RUN chart in the report of 27 October 2026, read from the image. The sum of the slices is derived.
| Country | Share of submissions | Derived count of 618 |
|---|---|---|
| United States | 47% | about 290 |
| India | 20% | about 124 |
| Canada | 7% | about 43 |
| United Kingdom | 5% | about 31 |
| Philippines | 3% | about 19 |
| Other | 18% | about 111 |
| Sum of the slices | 100% | 618 (derived, rounding aside) |
Read the table the way a defender should. A share of sandbox submissions is a share of who used the sandbox. It does not say that 47% of the phished organisations are American, and it says nothing at all about the organisations that never uploaded the file. The headline claim that American organisations are under attack is supported only in the thin sense that the largest group of people who uploaded these samples said they were in the United States.
Where a friendly label is standing in for a control
Labels in this story and what the record shows. Sources: ANY.RUN report of 27 October 2026, Microsoft documentation and Microsoft's Storm-2372 post.
| The label | What it suggests | What the record shows |
|---|---|---|
| MFA is on | The account is protected from phishing | The victim completes the sign in themselves, so the MFA step is performed by the genuine user. ANY.RUN says device code phishing can succeed with MFA enabled. Microsoft says such attacks attempt to evade MFA and that MFA stays essential |
| A real Microsoft page | Safe to type into | The sign in page is genuine, which is the point. The unsafe part is the code, which the attacker's page supplied. Microsoft notes the Azure prompt asks the user to confirm the app, an option it says is frequently missing from phishing sign ins |
| Password protected attachment | A confidential, secure document | The password is in the email body. Why the attacker locks the file is not stated in the report |
| Sentinel, authorised personnel only | A security product | The login panel of a phishing kit's operator console |
| Campaign | A defined set of victims and an actor | ANY.RUN calls it a kit, cannot separate one operator from several customers, and counts sandbox runs |
The control: block the device code flow, then prove nothing breaks
The Microsoft setting is named in the Conditional Access guide, last updated 7 April 2026 according to the page: in the Microsoft Entra admin center, under Conditional Access, create a policy; under Conditions choose Authentication flows, set Configure to Yes, and select Device code flow; under Grant, select Block access. Microsoft's guide says: "We recommend organizations get as close as possible to a unilateral block on device code flow." It recommends starting in Report only, exempting emergency access accounts, and allowing the flow only for documented use such as legacy tooling that cannot be updated.
Microsoft's authentication flows page adds two points a defender needs. First, how to find out whether anyone legitimately uses the flow: filter the Entra sign in logs by the Authentication Protocol filter set to Device code, or run the policy in report only mode. Second, protocol tracking: a session that began with device code flow stays tracked through later refreshes, so a policy can block a refresh token that came from a device code sign in. Microsoft gives the error code AADSTS530036 for that case and says that, if the policy applies to all applications, the token will never be usable.
ANY.RUN's own advice for security leaders points the same way, to review where device code authentication is genuinely required and to restrict or block unnecessary use through Conditional Access. Its advice for analysts is to hunt for requests to session_public.php with action=start and repeated action=poll, and to watch Entra ID logs for unexpected device code authentication that follows a suspicious email. The policy is a Microsoft setting, not something ANY.RUN sells.
Take this with you
Defender actions, in the order worth doing
- Find out who uses device code flow: filter Entra sign in logs by Authentication Protocol equal to Device code over the last 120 days, and name the device behind each user.
- Create a Conditional Access policy under Conditions, Authentication flows, Device code flow, with Grant set to Block access, for all users and all resources, and start it in Report only mode.
- Exclude emergency access accounts only, audit that list, and write down every other exception with an owner and a reason, such as a conference room device.
- Switch the policy from Report only to On once the report only results show no legitimate use is blocked.
- For any user who completed a device code sign in they cannot explain, revoke sign in sessions and review their mailbox and file activity since the sign in.
- Search web proxy and DNS logs for session_public.php, confirm_visit.php and the landing path shapes listed in the technical details, and match hits to the user who clicked.
- Treat a password protected attachment with the password in the email body as a mail handling rule candidate, a suggestion of this site and not a recommendation in the report.
- Tell staff the one rule that matches this kit: a page or document that gives you a code and asks you to type it into a Microsoft sign in page is the attack, because the genuine flow starts on a device with no easy way to type a sign in, such as a printer or a television.
Technical details
Every block below is copied from the source named in its caption, read on 28 October 2026. The ANY.RUN lists are as published in its post. ANY.RUN defangs live hosts with square brackets and this site keeps that form; do not make these into clickable links. Nothing here is a working exploit, a credential or a token. Where the report's page source holds placeholders in angle brackets that a browser hides, the placeholders are restored from the source.
The landing page. The report shows it as a screenshot, not as text, so the lines below are this site's transcription of the visible words, with the code replaced by a description. The browser tab title in the screenshot is Enter your credentials, with stray characters after it.
Sign in
Continue with your Microsoft account to proceed.
Enter this code on the Microsoft sign-in page:
[code shown by the page]
Copy View document
A pop-up window will open. Paste the code there to continue.
Email subjects and attachment names, from the report's MITRE table rows for impersonation and spearphishing attachment. These are the shapes of the lure, so a mail hunt can look for them.
Subjects: New Submission From <company>, Approved Statement and Fedwire Funds Service Processed-(<e-mail>)-<Base64>
Attachment names: <Organisation>-protected.pdf or <Company> DOC <10 random characters>.pdf
Types: PDF, XLS, DOCX and EML
Example SHA256: 9aa0b87974b9b4cd42603833b7ad44257578467d279b315a071108a5ed02c268
The kit's URL shapes and endpoints, the part of the report that a defender can search for in proxy, DNS and browser telemetry. The first two are the landing path tokens, the next two the session start and poll requests.
/<campaign path>/it[A-Za-z0-9]{32}us seen 2026-08-10 to 2026-10-19
/<campaign path>/zt[A-Za-z0-9]{32}op seen 2026-06-25 to 2026-09-28
/assets/php/endpoints/session_public.php?action=start&ip=<IP>&ip_address=<IP>&country=<cc>&country_code=<cc>&IP[ip]=<IP>&IP[country]=<cc>&city=…®ion=…&timezone=…&isp=…&org=…[&org_type=IPv4] seen 2026-06-23 to 2026-10-21
/assets/php/endpoints/session_public.php?action=poll&session_id=<UUIDv4> seen 2026-06-23 to 2026-10-21
/assets/js/client_geo.js seen 2026-07-07 to 2026-10-19
/assets/js/endpoint.js seen 2026-07-22 to 2026-10-20
/assets/js/url_helper.js seen 2026-07 to 2026-10
/assets/php/endpoints/confirm_visit.php seen 2026-08-31 to 2026-10-15
/assets/private_captcha/public/widget.js?v=4, /assets/private_captcha/public/widget.css, /assets/php/endpoints/private_captcha_challenge.php seen 2026-07-07 to 2026-09-28
/assets/php/attach/js/mstoken_document_(adobe|onedrive|excel)_[A-Za-z0-9]{50}.js seen 2026-07-20 to 2026-10-20
(docshare|sdocshares|pdocshared|pdfdocshared|efaxdoc|reauth|statement|copilot|login|auth).*(outlook|onedrive|copilot|office365).*.<look-alike domain> seen 2026-06 to 2026-10
Two more shapes from the MITRE table: the landing link can carry the recipient's email address after the token, and the genuine Microsoft endpoints the kit sends victims to. The Microsoft hosts are not indicators to block at a proxy, because they are the real service. The control for them is the Conditional Access policy above.
Landing link suffix: ?<recipient e-mail> or ??<Base64 e-mail> after /it[A-Za-z0-9]{32}us
Microsoft endpoints: login.microsoft[.]com/device and login.microsoftonline[.]com/common/oauth2/deviceauth
Polling: /assets/php/endpoints/session_public.php?action=poll&session_id=<UUIDv4>
Staging pages and infrastructure examples from the same table, then the full list of 173 hosting domains. The report does not say which of the 173 the operator registered and which are legitimate small business sites that were compromised, so a name on the list is not proof that its owner did anything. Some names read like ordinary businesses, and the report says only that they hosted the kit.
Free dynamic DNS hosts: flow505.mooo[.]com, bigbrain.chickenkiller[.]com and off365acess.jumpingcrab[.]com
Hosting: DigitalOcean (50 of 92 backend IP addresses), e.g. 162.243.64[.]121 and 67.205.154[.]32
Gabagool shared IP: 172.86.85[.]51 (priorispace[.]biz)
Staging pages: pub-177b3aa5a54d4f9087a649de5ec766d5.r2[.]dev/docsonedrive2026.html, carcabaoperadologistca.fr-par-1.linodeobjects[.]com/document_excel.html and bethom-contracting-llc.mintlify[.]site
Shared directories on shared hosts: 5200m[.]com/kvme2/, torvion[.]life/ofulium/, ghethim[.]com/hyllen/
0350pvas.acs-wcst[.]com
0ff365access.mooo[.]com
0utlook0ffice365admin.twilightparadox[.]com
1355bcra.ck29material[.]com
1717emxr.acs-wcst[.]com
5200m[.]com
5375jngu.prefform[.]us
6662nyde.acs-wcst[.]com
6695lkmo.prefform[.]us
7301eqny.acs-wcst[.]com
7criccasinobonus[.]cc
aachem-za[.]co
accordhealth[.]cc
acrobat-adobe-com-4464uswc.egllo[.]com
advancedsteelbuilding[.]com
alasilla[.]com
albertamo[.]com
alfabricationinc[.]com
apexpartsdepot[.]com
apinows[.]com
atlantictriad.ignorelist[.]com
atlassgroupinc[.]com
auth-loadingdocuments[.]online
auth.login.office365.cloud.onedrive.outlook.atlarchitacts[.]com
authorize.copilot.outlook.common.microsoft0365.atlarchitacts[.]com
awemode.outlookoffice365.microsoftcopilots.docshare.linnwest[.]us
azgymfloor[.]com
bandg-electrics[.]com
bennett002.mooo[.]com
bezpartien[.]online
bigbrain.chickenkiller[.]com
bloomfleldcapital[.]com
bramum[.]online
buckslu[.]org
bxcelcounselling[.]org
caine-wenier[.]com
calebchemicals[.]com
calmechc[.]net
canacedesotogroup[.]com
celestialtremor[.]org
celliottelliott-wellman[.]org
celvarioncorn[.]org
centipedtourspa[.]com
claronevents[.]com
cleggs.my03[.]com
clingard[.]pro
clubdenut[.]club
copilot.login.office365outlook.cloud.onedrive.atlarchitacts[.]com
copilots.outlook.cloud.microsoft.andersonelevators[.]com
copilots.outlook.cloud.microsoft.syrosconstructlon[.]com
coreansdmain[.]com
csr-rooflng[.]com
ctr-wooding[.]com
darap-it[.]co
detroitgardenswork[.]com
devtachsales[.]com
dguidrycardinazprofessional[.]com
docshare.auth.copilot.outlook.onedrive.common.earthlink-net[.]com
docshare.auth.copilot.outlook.onedrive.common.evergreenerg[.]com
docshare.auth.copilot.outlook.onedrive.common.northemheating[.]com
docshare.auth.copilot.outlook.onedrive.common0.evergreenerg[.]com
docshare.auth.copilot.outlookonedrive.common.northemheating[.]com
docshare.auth2026.onedrive.outlooksdocument.csr-rooflng[.]com
docshares.auth2026.outlookcommon.copilots.commm.csr-rooflng[.]com
document.akiflx[.]com
dpincoli[.]com
dutchfarrms[.]com
eccentric-authentication[.]com
ecosys.newdocument2026.pdfdocshared.tntileandmarbleinc[.]com
efaxdoc.auth.login.outlook.office365.tescoccontrols[.]com
efaxdoc.auth.outlook2026common.copilos26.bettylnc[.]com
efaxdoc.auth.outlook2026common.copilos26.ikextal-co-kr[.]com
efaxdoc.auth.outlook2026common.copilos26.kone-inc[.]com
efaxdoc.documents2026.cmc.docs.shared.matchlinemechanicallc[.]com
efaxdoc.documents2026.docs.shared.lakeviewscustom[.]com
eurosforgroup[.]com
flow505.mooo[.]com
flow55.chickenkiller[.]com
fosterswifts[.]com
frontdesk[.]click
gcotoncovingtoncontracting[.]com
ghethim[.]com
glafondbottamconstruction[.]com
globlasumi[.]com
gregor.justdied[.]com
grincool[.]xyz
haevy-llc[.]com
hcnyecom[.]com
hivezoom[.]com
ideahom[.]world
incommecialre[.]com
innvisoin[.]net
insigthinvestments[.]com
investomind[.]biz
jacobpwpinc[.]org
jjnysnobiogtx[.]org
kilishy.qhigh[.]com
kuer[.]online
lampadasdeslgn[.]com
lawyer.cuztools[.]com
lifetimeroofsystem[.]net
linking.mefound[.]com
linogomes-pt[.]cc
lionheartsecurityservice[.]com
liyuda[.]com
login.microsoft365.outlook.copilotsoffice365.lntactpr[.]com
login.office365outlooks.microsoft.cloud-outlook.naregruop[.]com
m365cloud.login.outlook.office365.azgymfloor[.]com
maqaigiapelhani[.]cam
metlarnelaw[.]com
metrorocl.co[.]uk
mgproparties[.]com
minda-mo[.]com
mouphyweb[.]com
naregruop[.]com
nicewayrealestate[.]cc
noxband[.]com
off365acess.jumpingcrab[.]com
off365mail[.]club
office0365login.2waky[.]com
outlookdrive.microsoftonline.common.oauth2.client.buycerm[.]com
outlookoffice365.microsoftcopilots.vigilantlnc[.]com
paulecosconnect[.]com
payapp.auth.outlook2026common.copilos26.bettylnc[.]com
pdfdocshared.auth.outlook2026common.copilos26.ikextal-co-kr[.]com
pdlhaelth[.]com
pdocshared.documents2026.docs.shared.ecmholdlnggroup[.]com
pdocshared.payments2026.outlooks.common.ecmholdlnggroup[.]com
photosofus[.]com
plusoptlx[.]com
priorispace[.]biz
psionicsandhorses[.]net
rapid-scale[.]net
reauth.copilot.auth.outlook.mcloud365.buycerm[.]com
reauth.copilot.auth.outlook.mcloud365.myhalnc[.]com
reauth.copilot.common.outlook.mcloud365.atlarchitacts[.]com
reauth.docs.copilot.auth02.outlook.mcloud365.argentventuras[.]com
rektham[.]online
rubinsrudman[.]com
rustlnsurance[.]com
sdocshares.auth.outlook.copilos26.general.csr-rooflng[.]com
sdocshares.auth.outlook2026common.copilos26.csr-rooflng[.]com
sdocshares.authoutlooks.common.copilots2026.hathormson[.]com
seatacsmarine[.]com
sedocs.docs.payrol2026.common.copilots2026.vatrarnsformer[.]com
shared.paymentsclouds.statementsapproved.jetbusinesscapltal[.]com
slybee[.]com
snk-s[.]org
solutions00fileptroduct[.]com
sorensenmaysflower[.]blog
statement.docdriveoauth.authorized.copilot.syrosconstructlon[.]com
statement.outlookoffice365.microsoftcopilots.calmechc[.]net
statements.outlook.office365microsoft.payment.run.stoneclty[.]com
stellarntis-fs[.]com
studeseliamechan[.]link
sunraycontractlng[.]com
sunstateaquips[.]com
swiftii.chickenkiller[.]com
tentkit[.]com
thepaybank[.]com
thewiginton[.]com
topcoatmetalsfinishing[.]com
toplinebuy[.]com
torvion[.]life
unitadrentals[.]com
unitedwirescompany[.]com
us-agricultures[.]com
vasquezmyth[.]com
westlakeproduces[.]com
whitfillsnursery[.]com
wsochares.authpayments.common.paid2026.bullochdirtwroks[.]com
wwriwashingtonenergy[.]com
zrs-wooding[.]com
The defender's side, from Microsoft. First the Conditional Access steps, copied from the Microsoft guide as read on 28 October 2026.
Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
Browse to Entra ID > Conditional Access > Policies.
Select New policy.
Under Assignments, select Users or workload identities.
Under Include, select the users you want to be in-scope for the policy (all users recommended).
Under Exclude:
Select Users and groups and choose your organization's emergency access or break-glass accounts and any other necessary users. Audit this exclusion list regularly.
Under Target resources > Resources (formerly cloud apps) > Include, select the apps you want to be in-scope for the policy (All resources (formerly 'All cloud apps') recommended).
Under Conditions > Authentication Flows, set Configure to Yes.
Select Device code flow.
Select Done.
Under Access controls > Grant, select Block access.
Select Select.
Confirm your settings and set Enable policy to Report-only.
Select Create to enable your policy.
After confirming your settings using policy impact or report-only mode, move the Enable policy toggle from Report-only to On.
The protocol shapes in Microsoft's device authorization grant page: the request that starts a flow, and the poll that a client makes with the device code. The identifiers in it are Microsoft's documentation samples, not live values. The kit's backend is not shown making these requests.
POST https://login.microsoftonline.com/{tenant}/oauth2/v2.0/devicecode
Content-Type: application/x-www-form-urlencoded
client_id=00001111-aaaa-2222-bbbb-3333cccc4444
&scope=user.read%20openid%20profile
POST https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
Content-Type: application/x-www-form-urlencoded
grant_type=urn:ietf:params:oauth:grant-type:device_code&client_id=00001111-aaaa-2222-bbbb-3333cccc4444&device_code=GMMhmHCXhWEzkobqIHGG_EnNYYsAkukHspeYUk9E8...
A hunting query. Microsoft published it in its Storm-2372 post of 13 February 2025 for Defender XDR, to find possible device code phishing: a click on a device login URL, then a risky sign in within minutes, then the error code 50199 followed by success. It is general, not specific to SkyW4lker, and it has not been tested here.
let suspiciousUserClicks = materialize(UrlClickEvents
| where ActionType in ("ClickAllowed", "UrlScanInProgress", "UrlErrorPage") or IsClickedThrough != "0"
| where UrlChain has_any ("microsoft.com/devicelogin", "login.microsoftonline.com/common/oauth2/deviceauth")
| extend AccountUpn = tolower(AccountUpn)
| project ClickTime = Timestamp, ActionType, UrlChain, NetworkMessageId, Url, AccountUpn);
//Check for Risky Sign-In in the short time window
let interestedUsersUpn = suspiciousUserClicks
| where isnotempty(AccountUpn)
| distinct AccountUpn;
let suspiciousSignIns = materialize(AADSignInEventsBeta
| where ErrorCode == 0
| where AccountUpn in~ (interestedUsersUpn)
| where RiskLevelDuringSignIn in (10, 50, 100)
| extend AccountUpn = tolower(AccountUpn)
| join kind=inner suspiciousUserClicks on AccountUpn
| where (Timestamp - ClickTime) between (-2min .. 7min)
| project Timestamp, ReportId, ClickTime, AccountUpn, RiskLevelDuringSignIn, SessionId, IPAddress, Url
);
//Validate errorCode 50199 followed by success in 5 minute time interval for the interested user, which suggests a pause to input the code from the phishing email
let interestedSessionUsers = suspiciousSignIns
| where isnotempty(AccountUpn)
| distinct AccountUpn;
let shortIntervalSignInAttemptUsers = materialize(AADSignInEventsBeta
| where AccountUpn in~ (interestedSessionUsers)
| where ErrorCode in (0, 50199)
| summarize ErrorCodes = make_set(ErrorCode) by AccountUpn, CorrelationId, SessionId
| where ErrorCodes has_all (0, 50199)
| distinct AccountUpn);
suspiciousSignIns
| where AccountUpn in (shortIntervalSignInAttemptUsers)
What the report does not print: no email headers, no raw email samples, no JavaScript, no Microsoft sign in log lines, no detection rules in a rule language, and no hashes other than the one example above. The block list therefore has to be built from the URL shapes and the domain list, and the identity side from Microsoft's logs.
The question the sandbox count cannot answer
618 analyses over 120 days say that a kit is circulating and that a lot of people thought a file worth checking. They do not say how many of those files ended in a token. That number lives in each organisation's own Entra sign in logs, and the logs can be read today, back to 23 June.
The exposing question is therefore a short one for any Microsoft 365 administrator. Can you name the one device in your organisation that legitimately needs the device code flow, and if you cannot, why is the flow still switched on for every user?
Key facts
Sources
- PrimaryANY.RUN blog, SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises, 27 October 2026, by the company's threat intelligence analyst. The primary: 618 sandbox analyses, the country split, the kit analysis, the Gabagool link, the IOCs and 173 domains. A vendor research post that promotes its own sandbox and a new featureANY.RUNaccessed 2026-10-28
- PrimaryMicrosoft Learn, Microsoft identity platform and the OAuth 2.0 device authorization grant flow: the legitimate flow, the 15 minute code life, the request and poll shapesMicrosoftaccessed 2026-10-28
- PrimaryMicrosoft Learn, Block authentication flows with Conditional Access policy, last updated 2026-04-07: the exact policy steps and the setting names Authentication flows and Device code flowMicrosoftaccessed 2026-10-28
- PrimaryMicrosoft Learn, Conditional Access: Authentication flows: why device code flow is called high risk, how to audit its use in sign in logs, and protocol tracking of refresh tokensMicrosoftaccessed 2026-10-28
- PrimaryMicrosoft Threat Intelligence, Storm-2372 conducts device code phishing campaign, 13 February 2025 with later updates: the mechanism, the mitigations including revokeSignInSessions, and a Defender XDR hunting queryMicrosoftaccessed 2026-10-28
