Modern phishing campaigns can compromise American businesses without relying on traditional credential theft. Attackers can abuse legitimate cloud services, authentication mechanisms, and trusted business workflows to gain access to corporate accounts while leaving fewer obvious signs behind.
ANY.RUN‘s analysis of Skyw4lker, a device code phishing campaign primarily targeting U.S. organizations, shows how this works in practice. The campaign has focused on manufacturing, technology, and healthcare, using business-themed documents, Google-hosted infrastructure, and Microsoft authentication flows to facilitate account compromise.
For security teams, the investigation goes beyond identifying the initial lure. It requires tracing the authentication flow and supporting infrastructure, extracting reliable indicators, and turning those findings into detections that can protect the wider organization.
Device Code Phishing: A Growing Challenge for U.S. Organizations
The scale of phishing in the United States provides an important backdrop. The FBI’s Internet Crime Complaint Center recorded 193,407 phishing and spoofing complaints in 2024, making it one of the most frequently reported categories of internet crime. In 2025, the FBI recorded more than 1 million internet crime complaints and $20.9 billion in reported losses, with reported losses increasing by 26% compared with the previous year.
Attackers are also adapting to organizations that have invested heavily in identity security and MFA.
Device code phishing is one example. Rather than collecting credentials through a fake login page, an attacker can initiate a legitimate device authorization flow and convince the victim to complete it. The resulting authentication tokens can then provide access to resources available to the compromised account.
How Skyw4lker Uses Legitimate Authentication to Compromise Accounts
How the Skyw4lker Campaign Works
Skyw4lker starts with a lure designed to resemble normal business correspondence, as observed in ANY.RUN’s Interactive Sandbox analysis.
 |
| The Skyw4lker phishing kit identified in ANY.RUN’s Interactive Sandbox |
Victims receive a password-protected document presented as a contract or service proposal. The scenario is credible in environments where employees routinely exchange vendor agreements, procurement documents, statements of work, and similar files.
From the document, the victim is directed toward a page hosted on sites[.]google[.]com, which eventually leads into a Microsoft authentication flow.
 |
| Skyw4lker redirecting the victims to a Microsoft365 authentication page |
The attacker does not need to reproduce Microsoft’s login experience perfectly. The authentication itself can be legitimate; the deception is in convincing the victim to complete an authentication request initiated by the attacker.
Once the process is completed, the attacker can obtain access to the resulting Microsoft 365 tokens.
That makes the attack difficult to evaluate through identity telemetry alone. An organization may see a valid authentication event without immediately seeing the malicious context that caused it. Establishing what happened requires the security team to connect the document, web activity, authentication flow, and associated infrastructure.
The Infrastructure Behind the Skyw4lker Phishing Page
The web infrastructure used by Skyw4lker provides additional evidence of the campaign’s operation.
ANY.RUN’s analysis identified obfuscated JavaScript and a PHP backend used to create a victim session, collect information such as IP address and geolocation, and repeatedly poll the backend while waiting for the authentication process to complete.
 |
| Skyw4lker sample submissions in ANY.RUN’s Interactive Sandbox by country |
A static inspection of the original document may reveal the starting URL, but it cannot fully explain what happens once the victim interacts with the page. The malicious behavior emerges through the combination of browser activity, JavaScript execution, backend communication, redirects, and authentication.
That makes behavioral analysis essential when the objective is to establish exactly what a phishing campaign is doing and which indicators can be trusted for follow-up detection.
View the Skyw4lker analysis in ANY.RUN’s Interactive Sandbox to see its complete attack chain and associated IOCs.
Reduce Tier 1 workload by up to 20% and give analysts more time to focus on critical threats.
Interactive Sandboxing Turns Suspicious Files and URLs into Actionable Evidence
An interactive sandbox lets security teams safely execute and interact with suspicious files, links, and documents, revealing behavior that static inspection can miss.
That matters in campaigns such as Skyw4lker, where the document is only the starting point. Analysts need to follow the attack through the browser, observe redirects and authentication activity, inspect network communication, and identify the infrastructure behind the phishing flow. All of this can be done in an isolated ANY.RUN Sandbox environment, with a result available in as little as 40 seconds.
 |
| The Tier 1 report for the observed Skyw4lker sample available in ANY.RUN’s sandbox |
Instead of stopping at a malicious/benign verdict, the investigation can produce URLs, domains, IP addresses, network activity, screenshots, behavioral evidence, and other IOCs. These findings give security teams the context needed to validate an alert, scope-related activity, and create detections from evidence gathered during a single investigation.
As a result, SOC and MSSP teams can reach a confident verdict faster without manually reproducing the attack across multiple tools, while the resulting intelligence can support threat hunting and detection across the wider environment. Moreover, the same workflow makes it easier for MSSPs to investigate new campaigns and turn findings from one customer case into intelligence that can be searched across other environments.
Turning Threat Intel into Earlier Detection
The value of an IOC increases when it can be used to detect another attack.
ANY.RUN Threat Intelligence Feeds (TI Feeds) provide malicious IPs, domains, URLs, and contextual information derived from sandbox investigations. 99% of unique, high-confidence IOCs are added to TI Feeds after validation, helping security teams work with intelligence that has already been reviewed.
 |
| ANY.RUN TI Feeds provide live threat intelligence for real-time attack detection |
ANY.RUN’s internal analysis found that up to 30% of unique malicious IOCs discovered in Interactive Sandbox sessions had already been observed by the company and were present in TI Feeds. When one of these indicators appears in customer telemetry, it can potentially be matched against existing intelligence before an analyst manually investigates the associated sample.
This creates a more efficient workflow: known malicious activity can be identified earlier, while sandbox analysis provides the behavioral evidence needed to investigate unfamiliar threats.
For internal SOCs, this can reduce time spent researching indicators that are already known to be malicious. For MSSPs, the same intelligence can help identify related activity across multiple customer environments. This is how the existing threat knowledge can be reused instead of reconstructed for every new alert.
Cut MTTR by 21 minutes and give your SOC more time to focus on critical threats.
Threat Intelligence Provides Context Behind the Alert
An indicator becomes more useful when security teams can understand the activity surrounding it.
ANY.RUN’s Threat Intelligence Lookup (TI Lookup) allows analysts to investigate a suspicious domain, IP address, or URL and examine its history and associated activity. In a Skyw4lker-related investigation, this context can help determine whether an indicator is connected to the campaign, has appeared in other malicious activity, or requires further investigation.
In addition, ANY.RUN’s Threat Intelligence Reports (TI Reports) provide a broader perspective by connecting indicators with campaigns, infrastructure, techniques, and observed behavior. This can reveal relationships that are difficult to see from individual alerts, such as multiple incidents sharing the same infrastructure or a suspicious domain belonging to a wider phishing operation.
When it comes to organizations in U.S. healthcare, manufacturing, and technology, those connections can be especially important. A compromised Microsoft 365 account can expose sensitive communications, intellectual property, operational information, and regulated data, making early identification of related activity critical.
How to Make Each SOC and MSSP Investigation More Valuable
A successful investigation should improve an organization’s ability to detect the next attack.
For an MSSP investigating a suspicious contract sent to one American manufacturing customer, indicators associated with Skyw4lker can be searched across other customer environments and incorporated into monitoring. The same approach works within an internal SOC environment, where an IOC found after one employee reports a phishing document can be compared against historical telemetry to identify other potentially affected users.
ANY.RUN supports these workflows through API/SDK, STIX/TAXII, SIEM, TIP, and XDR integrations, allowing intelligence from investigations to feed into existing detection and monitoring processes.
The result is broader protection from the same investigation: an incident affecting one user can generate intelligence that helps identify related activity across a SOC or MSSP’s wider customer base.
Uncover up to 58% more threats and gain broader visibility into emerging attacks.
Conclusion
Skyw4lker shows why modern phishing defense requires visibility beyond the initial lure or login page. By combining interactive sandboxing, threat intelligence, and contextual investigation, security teams can move faster from suspicious artifact to actionable intelligence and broader detection.
For organizations in the U.S., that means faster investigations, less repetitive manual work, and a better ability to identify related activity before it becomes a larger incident. The goal is not only to understand one attack, but to turn every investigation into protection against the next one.