Skip to content
Scammers.com
PhishingReviewed

SkyW4lker Microsoft 365 device-code phishing kit using csr-rooflng.com and ecmholdlnggroup.com

ANY.RUN reports that SkyW4lker (also called SkyW4lker x365 Sentinel) is an active device-code phishing kit targeting Microsoft 365 users, mainly in the United States. Phishing emails carry a password-protected attachm…

First reported
Reports
1

Source: any.run · published

Screenshot of the SkyW4lker phishing page showing a Microsoft device code for the victim to enter
Image: ANY.RUN

What happened

ANY.RUN reports that SkyW4lker (also called SkyW4lker x365 Sentinel) is an active device-code phishing kit targeting Microsoft 365 users, mainly in the United States. Phishing emails carry a password-protected attachment, with the password in the email body, using contract, invoice or proposal lures. After decoy pages the victim is asked to enter a Microsoft device code, which can give attackers account access without stealing passwords or bypassing MFA. ANY.RUN counted 618 sandbox analyses from June to 21 October 2026, up from 20 in June to 200 in September. It says the operator registered typo-squatted look-alike domains csr-rooflng.com and ecmholdlnggroup.com and used dynamic-DNS hosts including flow505.mooo.com, bigbrain.chickenkiller.com and off365acess.jumpingcrab.com. Microsoft and the companies whose names were imitated are not accused.

How the scam works

The attachment (a PDF, DOCX or XLSX) contains a link to a CAPTCHA page; some versions add a lure page hosted on a legitimate service such as Miro, Google Sites or Zoom. The victim finally reaches a page that tells them to enter a code on Microsoft's real authentication page. That is Microsoft's device-code sign-in: the code ties the attacker's pending session to whoever approves it, so approving it grants the attacker access to the account. Because the sign-in happens on a genuine Microsoft page, a password-and-MFA check is not what stops it.

ANY.RUN describes a PHP backend and obfuscated JavaScript. The page looks up the visitor's location and polls the backend every few seconds to see whether the victim has completed authentication. The backend also records email address, password, browser, MFA status and country. ANY.RUN says the kit shares modules, URL formats and part of its hosting with Gabagool, a credential phishing kit active since April 2026, and assesses with high confidence that the same developer built both.

ANY.RUN says submissions came mainly from technology, manufacturing and government organisations, most often in the United States, India, Canada and the United Kingdom. It describes the lures as ordinary business workflows such as contracts, invoices and service proposals.

Source

ANY.RUN, "SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises" (27 October 2026).

Red flags

  • An unexpected email about a contract, invoice or proposal with a password-protected attachment.
  • The password for the attachment is in the same email.
  • A page that tells you to enter a code on a Microsoft sign-in page that you did not start.
  • A CAPTCHA or document-share page before the sign-in step.
  • Look-alike domains with subtle typos (such as 'rooflng' for 'roofing').

If you were targeted

  1. 1Never enter a Microsoft device code unless you started the sign-in on your own device.
  2. 2Don't open password-protected attachments from unexpected senders; verify by calling the sender on a known number.
  3. 3If you entered a code, sign out of all sessions, revoke the device's access from your Microsoft account security page and change your password.
  4. 4Administrators should restrict device-code sign-in with Conditional Access where it isn't needed.
  5. 5Report the email to your security team and check the account's sign-in logs.
ReportFraud.ftc.gov FBI IC3 More resources