Zero Radar
← feed
HighSecurity incidentupdated 28 Oct 2026, 11:22 UTC

Phishing campaign tricks users into granting access to company cloud accounts

Attackers send fake messages that get people to approve a login code on a real Microsoft-style sign-in page, handing over access to work accounts without the attacker ever needing the password. Most of the targets are US organizations.

Attacks reported (The Hacker News)1 source, unconfirmed
SeverityHighSecurity incident
Being exploited?ReportedBy The Hacker News, not officially confirmed yet
What to doCheck exposureRestrict or disable device code authentication for users who do not need it, and tell staff never to enter codes sent to them by others.
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Phishing message sentLure asks user to sign in to view a document
  2. 2User starts device loginReal sign-in page shows a short code
  3. 3User enters attacker's codeVictim approves the code on the genuine site
  4. 4Tokens issued to attackerAttacker receives valid access tokens
  5. 5Attacker reads corporate dataAccess continues without the password
  6. ResultAttacker gains access to corporate accounts

What happened

A device code phishing campaign, tracked as Skyw4lker, abuses the OAuth device code sign-in flow in legitimate cloud services to obtain access tokens for corporate accounts. Analysis by ANY.RUN reports it primarily targets US organizations.

Why it is dangerous: Because the victim signs in on the real service, the attacker gets valid access tokens that can bypass some traditional credential and phishing defenses, leaving fewer obvious signs. Employees and IT teams in US organizations using cloud accounts are at risk.

Are you affected?

You are affected if your organization uses cloud identity or productivity accounts that support device code sign-in and users can be tricked into entering a code on a sign-in page.

What to do

  1. Warn staff that no legitimate login ever asks them to enter a code they were sent by email or chat
  2. Review and restrict or disable the device code sign-in flow in your cloud identity settings if your business does not need it
  3. Review recent sign-in logs for device code authentications and revoke any sessions you do not recognize

Timeline

  1. 28 Oct 2026, 10:30 UTC
    Publicly disclosed
  2. 28 Oct 2026, 10:30 UTC
    Reported by The Hacker News · The Hacker News
  3. 28 Oct 2026, 11:22 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Security press established security newsrooms

Technical details

ID
ZR-169a3a02
Disclosed
28 Oct 2026, 10:30 UTC
On Zero Radar
28 Oct 2026, 11:22 UTC (52 min after disclosure)
Last change
28 Oct 2026, 11:22 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Phishing campaign tricks users into granting access to company cloud accounts · Zero Radar