Cyber Blog

American businesses and organizations are facing a phishing campaign known as Skyw4lker, which uses convincing business documents and legitimate Microsoft login systems to gain access to company accounts. The campaign has focused on organizations in manufacturing, technology, and healthcare, using methods that can make the attacks difficult to recognize. Instead of relying on fake login pages alone, the attackers exploit a legitimate authentication process to trick people into granting access to their accounts.

Phishing is a type of online scam in which criminals pretend to be a trusted person or organization to convince someone to reveal information or approve an action. Many people are familiar with suspicious emails asking them to reset a password or click an unfamiliar link. However, modern phishing attacks have become more sophisticated. Some criminals now use real websites and legitimate login systems to make their attacks appear trustworthy, which can make them harder to detect.

The Skyw4lker campaign begins with a document that looks like an ordinary business file, such as a contract or service proposal. In industries where employees regularly receive agreements from vendors, suppliers, and business partners, these documents may not immediately raise suspicion. The file directs the recipient toward a webpage hosted through Google’s website infrastructure, which then leads into a Microsoft authentication process.

The danger is that the Microsoft login process itself can be legitimate. Rather than sending the victim to a completely fake login page, the attacker takes advantage of a feature designed to help people sign in to certain devices and applications. This technique is known as device code phishing.

To understand how this works, imagine someone asking you to approve a delivery or sign a document. The request appears routine, so you follow the instructions without realizing that the action is helping someone else gain access to your account. Device code phishing works in a similar way. The attacker starts an authentication request and persuades the victim to complete it, effectively authorizing access that the attacker initiated.

Once the victim completes the process, the attacker may obtain authentication tokens associated with the account. These tokens are digital credentials that tell an online service that a user has successfully signed in. They can allow access to services without requiring the user to enter a password every time. If criminals obtain and misuse these tokens, they may be able to access Microsoft 365 resources available to the compromised account.

This is particularly concerning for businesses because Microsoft 365 is widely used for email, document storage, collaboration, and other daily work activities. A compromised account could expose sensitive messages, internal files, business plans, or other confidential information. Depending on the permissions attached to the account, an attacker might also use it to target other employees or send convincing phishing messages from a trusted company address.

One reason these attacks are difficult to identify is that the login activity may appear legitimate. Security systems might record a successful authentication without immediately revealing that the user was tricked into approving an attacker-controlled request. Investigators therefore need to look beyond the login event and connect it with the document the victim received, the websites they visited, and the authentication activity that followed.

Researchers examining Skyw4lker also identified technical components designed to support the phishing operation. The campaign used JavaScript, a programming language commonly used to make websites interactive, along with a server-side program that helped manage the attack. These components collected information about visitors, including their internet addresses and approximate locations, and repeatedly checked whether the authentication process had been completed.

This information can help attackers manage their campaign and determine when a victim has reached a particular stage of the process. The website and its supporting systems work together to guide the victim through the authentication steps, making the attack more than a simple email containing a suspicious link.

The findings highlight why examining a suspicious document alone may not be enough to understand an attack. Security researchers need to follow the entire process, including what happens when someone opens the file, which websites the browser visits, how the authentication request works, and what information is exchanged behind the scenes. By examining these behaviors in a controlled environment, investigators can identify the infrastructure used by the attackers and develop ways to recognize similar activity in the future.

The campaign also demonstrates why multi-factor authentication, while important, is not a complete solution on its own. Multi-factor authentication, or MFA, adds another layer of protection beyond a password, such as a code, an authentication app, or a security key. However, device code phishing can trick a user into approving an authentication request that ultimately benefits the attacker. This means organizations need to protect the entire sign-in process, not just require users to provide more than one form of verification.

Businesses can reduce their exposure by educating employees about unusual sign-in requests, especially those that ask them to enter a code or approve access when they did not initiate the process themselves. Employees should be cautious when opening unexpected contracts or service proposals, even when the documents appear relevant to their work. If a login request appears unexpectedly, they should stop and verify whether it was triggered by a legitimate action.

Organizations should also monitor account sign-ins, review unusual authentication activity, and investigate suspicious access to email and document services. Administrators can apply identity security policies that restrict risky sign-in methods, limit access based on the circumstances of a login, and require additional verification when activity appears unusual. If an account is suspected of being compromised, security teams should revoke active sessions and authentication tokens, reset credentials where appropriate, and check whether the attacker accessed or changed any information.

For everyday users, this campaign is a reminder that a website looking familiar does not necessarily mean the action being requested is safe. Even when a login page belongs to a legitimate service, someone may be using that service to trick you into granting access. Before approving an unexpected sign-in request, consider whether you started it yourself and whether the instructions make sense for the task you were trying to complete.

Ultimately, Skyw4lker illustrates how phishing is evolving. Attackers no longer need to rely entirely on fake websites or stolen passwords. By abusing legitimate authentication processes and disguising their requests as normal business activities, they can attempt to gain access while leaving fewer obvious signs of fraud. For organizations that rely on cloud services to communicate and store information, protecting employee accounts requires a combination of user awareness, careful monitoring, and strong identity security controls. The goal is not only to stop suspicious emails, but also to prevent a seemingly ordinary login process from becoming a doorway into an organization’s digital systems.