Skyw4lker Uses Contracts to Hijack M365 Access

The Skyw4lker campaign targets U.S. manufacturing, technology, and healthcare organizations with password-protected documents disguised as contracts or service proposals. Victims are sent through a Google-hosted page into a legitimate Microsoft authentication process, where completing an attacker-initiated device authorization request can give the attacker access to Microsoft 365 account tokens without stealing a password.

Key findings

• Skyw4lker uses password-protected documents presented as contracts or service proposals to make its lure appear like routine business correspondence.
• The campaign directs victims from a document to a Google-hosted page and then into a legitimate Microsoft authentication flow.
• Rather than collecting a password through a fake login page, the attacker persuades the victim to approve a device authorization flow initiated by the attacker.
• Completing the authorization can give the attacker access to Microsoft 365 tokens associated with the victim's account.
• The campaign has primarily targeted U.S. manufacturing, technology, and healthcare organizations.

Who’s being targeted

• Commonly targeted roles: Procurement, Vendor management, Operations, Legal, Finance, Healthcare administration, Manufacturing employees, Technology employees, All Microsoft 365 users.
• Affected industries: Manufacturing, Technology, Healthcare.
• Attack channels: website.
• Impersonated: A business vendor or service provider presenting a contract or proposal.

Awareness takeaways

• Treat unexpected password-protected contracts, proposals, and supplier documents as suspicious, especially when you were not expecting them or cannot independently confirm the sender.
• Do not approve a Microsoft device sign-in or authorization request unless you personally started it for a device or application you recognize.
• Verify document links and authentication requests through a known vendor contact or established portal rather than trusting redirects embedded in a document.

Red flags to watch for

• An unexpected password-protected document arrives as a contract or proposal.
• The document redirects through a Google-hosted page instead of a known vendor portal.
• The Microsoft authentication request was not initiated by the recipient for a device they are setting up.