American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed

The Skyw4lker campaign is a device code phishing operation primarily targeting U.S.-based organizations. Rather than relying on traditional credential theft, attackers abuse legitimate cloud services, authentication mechanisms, and trusted business workflows to gain unauthorized access to corporate accounts. The campaign was analyzed by ANY.RUN, which exposed its methodology and scope. Device code phishing exploits OAuth device authorization flows to trick users into granting attackers access tokens. This technique leaves fewer obvious signs of compromise compared to conventional phishing. The campaign highlights the growing trend of attackers leveraging legitimate infrastructure to bypass security controls.