SkyW4lker Device-Code Phishing Hits 618 Cases, 46% US, Linked to Gabagool Infrastructure
SkyW4lker and fake-AI phishing campaigns exploited Microsoft device-code auth and trusted platforms in 1,876 combined sandbox cases through October 2026. US organizations accounted for nearly half of submissions, with infrastructure links to prior Gabagool activity across multiple sectors. The campaigns demonstrate ongoing abuse of legitimate authentication rather than new exploits.
October 2026 campaigns centered on SkyW4lker phishing emails that route victims through CAPTCHA and trusted platforms to Microsoft's own device-code login page. Attackers then use the resulting session for account access. Parallel fake-AI lures impersonating Claude and ChatGPT delivered cookie-stealing malware alongside legitimate installers, yielding 1,258 related analyses with the US ranking second globally.
Sandbox pivots from SkyW4lker sessions directly surfaced IP 198.23.223.185 and technical overlap with the Gabagool kit. Submissions spanned technology, government, healthcare, and education sectors across the US, Latin America, and Europe. The pattern shows repeated abuse of OAuth and device-code flows first documented in 2023-2025 enterprise incidents rather than novel zero-days.
Evidence indicates these kits lower the barrier for credential access while preserving session integrity to evade MFA prompts. Conditional Access restrictions on device-code authentication remain inconsistently applied, allowing the technique to persist despite vendor guidance. Related Threat Context tooling reduced manual pivots by connecting one URL to multi-sector IOCs in seconds.
Enterprises should enforce Entra Conditional Access policies blocking device-code flows for non-managed devices and hunt for the listed IP and related URLs. Continued monitoring of AI-themed lures is required as adoption expands attack surface.
Sources (3)
- [1]ANY.RUN Sandbox Analysis(https://any.run/reports/skyw4lker-oct2026)
- [2]The Hacker News(https://thehackernews.com/2026/11/5-active-cyber-threats-that-put-us.html)
- [3]Microsoft Entra Conditional Access Guidance(https://learn.microsoft.com/en-us/entra/identity/conditional-access/)