Skyw4lker Exploits Device-Code Logins to Breach US Corporate Accounts

En bref

• Skyw4lker operators conduct device-code phishing against US entities.
• ANY.RUN observed misuse of cloud platforms and login mechanisms.
• The campaign yields access to company accounts with less credential theft and fewer conspicuous indicators.
• No CVE is involved; defenses should center on identity controls and conditional access.

Researchers at ANY.RUN have documented a campaign by a crew tracked as Skyw4lker that relies on device-code sign-in prompts to trick users into approving access. The operators misuse cloud platforms and corporate processes to reach their objectives, and their focus is American companies. No software vulnerability or CVE is part of the activity described.

The impact is direct: attackers obtain access to company accounts. Because the method does not depend on stealing passwords, it results in less credential theft and fewer conspicuous indicators than conventional phishing. That combination makes the intrusion harder to spot through familiar alerts and puts any US entity that uses cloud identity providers supporting device-code flow at potential risk.

The campaign matters because it exploits legitimate login mechanisms rather than malware or unpatched software. Device-code phishing can sidestep some traditional protections and blend into normal authentication traffic. ANY.RUN's disclosure adds to the growing pattern of identity-focused attacks that abuse cloud platforms and business processes instead of relying on obvious credential harvesting.

Defenders should watch for unexpected device-code sign-ins, unusual token issuance, and consent grants to unfamiliar applications. Reviewing conditional access policies, limiting device-code flow where it is not needed, and educating users about unsolicited login prompts are practical near-term steps. Organizations should also monitor cloud audit logs for anomalous account access and be ready to revoke sessions and permissions quickly.

À faire maintenant

1. Audit identity provider settings and restrict or block device-code flow where business processes do not require it.
2. Enforce conditional access policies that require compliant devices and strong authentication for cloud sign-ins.
3. Monitor sign-in and audit logs for device-code authentication, anomalous token issuance, and unusual IP addresses.
4. Train users to reject unsolicited device-code prompts and report them to security teams immediately.
5. Review OAuth application consents and cloud service permissions; revoke suspicious grants and enforce least privilege.
6. Limit business workflow integrations and service principals, and require approval for new cloud app registrations.
7. Prepare an incident response playbook for token theft that includes rapid session revocation and credential rotation.

Source originale

The Hacker News