ANY.RUN exposes Skyw4lker device code phishing campaign targeting US firms

ANY.RUN analyzed Skyw4lker, a device code phishing campaign aimed primarily at U.S. organizations. Attackers abuse legitimate cloud services and authentication mechanisms to hijack corporate accounts while leaving fewer obvious traces.

• Skyw4lker campaign relies on device code phishing
• Targets are mainly U.S.-based organizations
• Abuses legitimate cloud services and authentication flows
• Leaves fewer obvious signs than traditional credential theft