Act
active
Skyw4lker Device Code Phishing Campaign Targets U.S. Orgs
- Engineer — Plan: Device code phishing abuses the OAuth device authorization grant, which many cloud tenants leave unrestricted by default; audit Conditional Access policies in Entra ID to block or scope device code flow to legitimate managed devices only.
- SOC/IR — Act: Active named campaign targeting U.S. organizations via device code auth abuse — hunt for anomalous device code authentication events in Entra ID/M365 sign-in logs (filter on ‘DeviceCode’ grant type) and flag suspicious OAuth token issuances since at least early October 2026.
- Leader — Learn: This campaign highlights that modern account takeover can succeed through legitimate auth flows rather than credential theft, making it harder to detect via traditional controls; useful framing for risk conversations but no immediate leadership action required absent a confirmed breach at a dependent vendor.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.