AMERICAN ORGANIZATIONS UNDER ATTACK: SKYW4LKER DEVICE CODE PHISHING CAMPAIGN EXPOSED

Summary from the TLDR InfoSec newsletter

Skyw4lker targets US manufacturing, technology, and healthcare organizations through device code phishing. Password-protected contracts or proposals send victims through Google Sites into legitimate Microsoft authentication flows. Completing attacker-initiated authorization gives attackers Microsoft 365 tokens. ANY.RUN identified obfuscated JavaScript and a PHP backend tracking victim sessions, IP addresses, and geolocation, and the backend repeatedly polls for authentication completion.