A campaign called Skyw4lker uses fake contracts to get workers to approve a real Microsoft sign-in that hackers started, giving them access to the account.
Security researchers have exposed a phishing campaign called Skyw4lker that does not steal passwords. Instead, it tricks a worker into approving a genuine Microsoft sign-in that the attacker began. The campaign mainly targets US organizations in manufacturing, technology and healthcare, according to analysis by the security firm ANY.RUN.
The bait is a password-protected file that looks like a contract or service proposal. That is a believable message in any workplace that swaps vendor agreements and statements of work. The file sends the victim to a page hosted on Google Sites, which then leads into a Microsoft sign-in process.
This is called device code phishing. The attacker starts a real sign-in request and persuades the victim to complete it. There is no fake login page to spot. Once it is done, the attacker can collect Microsoft 365 tokens, which are digital keys that keep an account signed in and give access to what that account can reach.
Many companies have added extra login codes, known as multi-factor authentication, to protect accounts. This trick goes around that protection. The worker is the one who approves the sign-in, so a strong password and a login code do not help.
It is also hard to catch. A company may see a valid sign-in in its records without seeing the fake contract that caused it. ANY.RUN also found the attackers' web pages quietly record the victim's IP address and location, then keep checking in while they wait for the sign-in to finish.
Phishing is already common. The FBI logged 193,407 phishing and spoofing complaints in 2024.
The reported focus is US organizations that use Microsoft 365, especially in manufacturing, technology and healthcare. People who handle contracts, vendor files and procurement are the likeliest targets. The material does not say other industries are safe, so anyone who gets an unexpected protected file should be careful.
The alert box above lists the steps. The short version is to confirm unexpected files with the sender through a separate channel, and to tell IT right away if you approved something by mistake.
The material does not say how many organizations were hit or who is behind the campaign. It also does not say how many victims approved the sign-in request.
Never approve a Microsoft sign-in you did not start yourself, even if it follows a contract from a name you know.
A viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you callThe Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone calls
