SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises

    Date: 10/28/2026

    Severity: Critical

    Summary

    Researchers analyzed SkyW4lker, also known as SkyW4lker x365 Sentinel, a phishing kit targeting Microsoft 365 accounts through OAuth device-code phishing. The campaign uses password-protected email attachments, CAPTCHA gates, decoy pages, and obfuscated JavaScript to trick victims into authenticating through legitimate Microsoft pages, enabling attackers to obtain access tokens without directly stealing passwords or bypassing MFA. Observed activity targeted organizations across the United States, India, Canada, and the United Kingdom, with phishing infrastructure using geolocation checks and backend polling to track authentication.

    Indicators of Compromise (IOC) List

    Domain/Urls

    0350pvas.acs-wcst.com

    0ff365access.mooo.com

    0utlook0ffice365admin.twilightparadox.com

    1355bcra.ck29material.com

    1717emxr.acs-wcst.com

    5200m.com

    5375jngu.prefform.us

    6662nyde.acs-wcst.com

    6695lkmo.prefform.us

    7301eqny.acs-wcst.com

    7criccasinobonus.cc

    aachem-za.co

    accordhealth.cc

    acrobat-adobe-com-4464uswc.egllo.com

    advancedsteelbuilding.com

    alasilla.com

    albertamo.com

    alfabricationinc.com

    apexpartsdepot.com

    apinows.com

    atlantictriad.ignorelist.com

    atlassgroupinc.com

    auth-loadingdocuments.online

    auth.login.office365.cloud.onedrive.outlook.atlarchitacts.com

    authorize.copilot.outlook.common.microsoft0365.atlarchitacts.com

    awemode.outlookoffice365.microsoftcopilots.docshare.linnwest.us

    azgymfloor.com

    bandg-electrics.com

    bennett002.mooo.com

    bezpartien.online

    bigbrain.chickenkiller.com

    bloomfleldcapital.com

    bramum.online

    buckslu.org

    bxcelcounselling.org

    caine-wenier.com

    calebchemicals.com

    calmechc.net

    canacedesotogroup.com

    celestialtremor.org

    celliottelliott-wellman.org

    celvarioncorn.org

    centipedtourspa.com

    claronevents.com

    cleggs.my03.com

    clingard.pro

    clubdenut.club

    copilot.login.office365outlook.cloud.onedrive.atlarchitacts.com

    copilots.outlook.cloud.microsoft.andersonelevators.com

    copilots.outlook.cloud.microsoft.syrosconstructlon.com

    coreansdmain.com

    csr-rooflng.com

    ctr-wooding.com

    darap-it.co

    detroitgardenswork.com

    devtachsales.com

    dguidrycardinazprofessional.com

    docshare.auth.copilot.outlook.onedrive.common.earthlink-net.com

    docshare.auth.copilot.outlook.onedrive.common.evergreenerg.com

    docshare.auth.copilot.outlook.onedrive.common.northemheating.com

    docshare.auth.copilot.outlook.onedrive.common0.evergreenerg.com

    docshare.auth.copilot.outlookonedrive.common.northemheating.com

    docshare.auth2026.onedrive.outlooksdocument.csr-rooflng.com

    docshares.auth2026.outlookcommon.copilots.commm.csr-rooflng.com

    document.akiflx.com

    dpincoli.com

    dutchfarrms.com

    eccentric-authentication.com

    ecosys.newdocument2026.pdfdocshared.tntileandmarbleinc.com

    efaxdoc.auth.login.outlook.office365.tescoccontrols.com

    efaxdoc.auth.outlook2026common.copilos26.bettylnc.com

    efaxdoc.auth.outlook2026common.copilos26.ikextal-co-kr.com

    efaxdoc.auth.outlook2026common.copilos26.kone-inc.com

    efaxdoc.documents2026.cmc.docs.shared.matchlinemechanicallc.com

    efaxdoc.documents2026.docs.shared.lakeviewscustom.com

    eurosforgroup.com

    flow505.mooo.com

    flow55.chickenkiller.com

    fosterswifts.com

    frontdesk.click

    gcotoncovingtoncontracting.com

    ghethim.com

    glafondbottamconstruction.com

    globlasumi.com

    gregor.justdied.com

    grincool.xyz

    haevy-llc.com

    hcnyecom.com

    hivezoom.com

    ideahom.world

    incommecialre.com

    innvisoin.net

    insigthinvestments.com

    investomind.biz

    jacobpwpinc.org

    jjnysnobiogtx.org

    kilishy.qhigh.com

    kuer.online

    lampadasdeslgn.com

    lawyer.cuztools.com

    lifetimeroofsystem.net

    linking.mefound.com

    linogomes-pt.cc

    lionheartsecurityservice.com

    liyuda.com

    login.microsoft365.outlook.copilotsoffice365.lntactpr.com

    login.office365outlooks.microsoft.cloud-outlook.naregruop.com

    m365cloud.login.outlook.office365.azgymfloor.com

    maqaigiapelhani.cam

    metlarnelaw.com

    metrorocl.co.uk

    mgproparties.com

    minda-mo.com

    mouphyweb.com

    naregruop.com

    nicewayrealestate.cc

    noxband.com

    off365acess.jumpingcrab.com

    off365mail.club

    office0365login.2waky.com

    outlookdrive.microsoftonline.common.oauth2.client.buycerm.com

    outlookoffice365.microsoftcopilots.vigilantlnc.com

    paulecosconnect.com

    payapp.auth.outlook2026common.copilos26.bettylnc.com

    pdfdocshared.auth.outlook2026common.copilos26.ikextal-co-kr.com

    pdlhaelth.com

    pdocshared.documents2026.docs.shared.ecmholdlnggroup.com

    pdocshared.payments2026.outlooks.common.ecmholdlnggroup.com

    photosofus.com

    plusoptlx.com

    priorispace.biz

    psionicsandhorses.net

    rapid-scale.net

    reauth.copilot.auth.outlook.mcloud365.buycerm.com

    reauth.copilot.auth.outlook.mcloud365.myhalnc.com

    reauth.copilot.common.outlook.mcloud365.atlarchitacts.com

    reauth.docs.copilot.auth02.outlook.mcloud365.argentventuras.com

    rektham.online

    rubinsrudman.com

    rustlnsurance.com

    sdocshares.auth.outlook.copilos26.general.csr-rooflng.com

    sdocshares.auth.outlook2026common.copilos26.csr-rooflng.com

    sdocshares.authoutlooks.common.copilots2026.hathormson.com

    seatacsmarine.com

    sedocs.docs.payrol2026.common.copilots2026.vatrarnsformer.com

    shared.paymentsclouds.statementsapproved.jetbusinesscapltal.com

    slybee.com

    snk-s.org

    solutions00fileptroduct.com

    sorensenmaysflower.blog

    statement.docdriveoauth.authorized.copilot.syrosconstructlon.com

    statement.outlookoffice365.microsoftcopilots.calmechc.net

    statements.outlook.office365microsoft.payment.run.stoneclty.com

    stellarntis-fs.com

    studeseliamechan.link

    sunraycontractlng.com

    sunstateaquips.com

    swiftii.chickenkiller.com

    tentkit.com

    thepaybank.com

    thewiginton.com

    topcoatmetalsfinishing.com

    toplinebuy.com

    torvion.life

    unitadrentals.com

    unitedwirescompany.com

    us-agricultures.com

    vasquezmyth.com

    westlakeproduces.com

    whitfillsnursery.com

    wsochares.authpayments.common.paid2026.bullochdirtwroks.com

    wwriwashingtonenergy.com

    zrs-wooding.com

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    domainname like "globlasumi.com" or url like "globlasumi.com" or siteurl like "globlasumi.com" or domainname like "ghethim.com" or url like "ghethim.com" or siteurl like "ghethim.com" or domainname like "calmechc.net" or url like "calmechc.net" or siteurl like "calmechc.net" or domainname like "hivezoom.com" or url like "hivezoom.com" or siteurl like "hivezoom.com" or domainname like "copilot.login.office365outlook.cloud.onedrive.atlarchitacts.com" or url like "copilot.login.office365outlook.cloud.onedrive.atlarchitacts.com" or siteurl like "copilot.login.office365outlook.cloud.onedrive.atlarchitacts.com" or domainname like "1355bcra.ck29material.com" or url like "1355bcra.ck29material.com" or siteurl like "1355bcra.ck29material.com" or domainname like "sunstateaquips.com" or url like "sunstateaquips.com" or siteurl like "sunstateaquips.com" or domainname like "claronevents.com" or url like "claronevents.com" or siteurl like "claronevents.com" or domainname like "aachem-za.co" or url like "aachem-za.co" or siteurl like "aachem-za.co" or domainname like "rektham.online" or url like "rektham.online" or siteurl like "rektham.online" or domainname like "torvion.life" or url like "torvion.life" or siteurl like "torvion.life" or domainname like "zrs-wooding.com" or url like "zrs-wooding.com" or siteurl like "zrs-wooding.com" or domainname like "unitadrentals.com" or url like "unitadrentals.com" or siteurl like "unitadrentals.com" or domainname like "bennett002.mooo.com" or url like "bennett002.mooo.com" or siteurl like "bennett002.mooo.com" or domainname like "reauth.copilot.auth.outlook.mcloud365.myhalnc.com" or url like "reauth.copilot.auth.outlook.mcloud365.myhalnc.com" or siteurl like "reauth.copilot.auth.outlook.mcloud365.myhalnc.com" or domainname like "azgymfloor.com" or url like "azgymfloor.com" or siteurl like "azgymfloor.com" or domainname like "linking.mefound.com" or url like "linking.mefound.com" or siteurl like "linking.mefound.com" or domainname like "unitedwirescompany.com" or url like "unitedwirescompany.com" or siteurl like "unitedwirescompany.com" or domainname like "mouphyweb.com" or url like "mouphyweb.com" or siteurl like "mouphyweb.com" or domainname like "sedocs.docs.payrol2026.common.copilots2026.vatrarnsformer.com" or url like "sedocs.docs.payrol2026.common.copilots2026.vatrarnsformer.com" or siteurl like "sedocs.docs.payrol2026.common.copilots2026.vatrarnsformer.com" or domainname like "document.akiflx.com" or url like "document.akiflx.com" or siteurl like "document.akiflx.com" or domainname like "statement.docdriveoauth.authorized.copilot.syrosconstructlon.com" or url like "statement.docdriveoauth.authorized.copilot.syrosconstructlon.com" or siteurl like "statement.docdriveoauth.authorized.copilot.syrosconstructlon.com" or domainname like "statements.outlook.office365microsoft.payment.run.stoneclty.com" or url like "statements.outlook.office365microsoft.payment.run.stoneclty.com" or siteurl like "statements.outlook.office365microsoft.payment.run.stoneclty.com" or domainname like "centipedtourspa.com" or url like "centipedtourspa.com" or siteurl like "centipedtourspa.com" or domainname like "efaxdoc.auth.outlook2026common.copilos26.ikextal-co-kr.com" or url like "efaxdoc.auth.outlook2026common.copilos26.ikextal-co-kr.com" or siteurl like "efaxdoc.auth.outlook2026common.copilos26.ikextal-co-kr.com" or domainname like "flow505.mooo.com" or url like "flow505.mooo.com" or siteurl like "flow505.mooo.com" or domainname like "liyuda.com" or url like "liyuda.com" or siteurl like "liyuda.com" or domainname like "celliottelliott-wellman.org" or url like "celliottelliott-wellman.org" or siteurl like "celliottelliott-wellman.org" or domainname like "off365acess.jumpingcrab.com" or url like "off365acess.jumpingcrab.com" or siteurl like "off365acess.jumpingcrab.com" or domainname like "pdlhaelth.com" or url like "pdlhaelth.com" or siteurl like "pdlhaelth.com" or domainname like "outlookoffice365.microsoftcopilots.vigilantlnc.com" or url like "outlookoffice365.microsoftcopilots.vigilantlnc.com" or siteurl like "outlookoffice365.microsoftcopilots.vigilantlnc.com" or domainname like "thepaybank.com" or url like "thepaybank.com" or siteurl like "thepaybank.com" or domainname like "efaxdoc.auth.login.outlook.office365.tescoccontrols.com" or url like "efaxdoc.auth.login.outlook.office365.tescoccontrols.com" or siteurl like "efaxdoc.auth.login.outlook.office365.tescoccontrols.com" or domainname like "accordhealth.cc" or url like "accordhealth.cc" or siteurl like "accordhealth.cc" or domainname like "sorensenmaysflower.blog" or url like "sorensenmaysflower.blog" or siteurl like "sorensenmaysflower.blog" or domainname like "1717emxr.acs-wcst.com" or url like "1717emxr.acs-wcst.com" or siteurl like "1717emxr.acs-wcst.com" or domainname like "investomind.biz" or url like "investomind.biz" or siteurl like "investomind.biz" or domainname like "pdocshared.documents2026.docs.shared.ecmholdlnggroup.com" or url like "pdocshared.documents2026.docs.shared.ecmholdlnggroup.com" or siteurl like "pdocshared.documents2026.docs.shared.ecmholdlnggroup.com" or domainname like "celvarioncorn.org" or url like "celvarioncorn.org" or siteurl like "celvarioncorn.org" or domainname like "docshare.auth.copilot.outlook.onedrive.common.evergreenerg.com" or url like "docshare.auth.copilot.outlook.onedrive.common.evergreenerg.com" or siteurl like "docshare.auth.copilot.outlook.onedrive.common.evergreenerg.com" or domainname like "cleggs.my03.com" or url like "cleggs.my03.com" or siteurl like "cleggs.my03.com" or domainname like "darap-it.co" or url like "darap-it.co" or siteurl like "darap-it.co" or domainname like "jacobpwpinc.org" or url like "jacobpwpinc.org" or siteurl like "jacobpwpinc.org" or domainname like "us-agricultures.com" or url like "us-agricultures.com" or siteurl like "us-agricultures.com" or domainname like "office0365login.2waky.com" or url like "office0365login.2waky.com" or siteurl like "office0365login.2waky.com" or domainname like "alasilla.com" or url like "alasilla.com" or siteurl like "alasilla.com" or domainname like "incommecialre.com" or url like "incommecialre.com" or siteurl like "incommecialre.com" or domainname like "alfabricationinc.com" or url like "alfabricationinc.com" or siteurl like "alfabricationinc.com" or domainname like "csr-rooflng.com" or url like "csr-rooflng.com" or siteurl like "csr-rooflng.com" or domainname like "minda-mo.com" or url like "minda-mo.com" or siteurl like "minda-mo.com" or domainname like "reauth.docs.copilot.auth02.outlook.mcloud365.argentventuras.com" or url like "reauth.docs.copilot.auth02.outlook.mcloud365.argentventuras.com" or siteurl like "reauth.docs.copilot.auth02.outlook.mcloud365.argentventuras.com" or domainname like "topcoatmetalsfinishing.com" or url like "topcoatmetalsfinishing.com" or siteurl like "topcoatmetalsfinishing.com" or domainname like "off365mail.club" or url like "off365mail.club" or siteurl like "off365mail.club" or domainname like "wwriwashingtonenergy.com" or url like "wwriwashingtonenergy.com" or siteurl like "wwriwashingtonenergy.com" or domainname like "dpincoli.com" or url like "dpincoli.com" or siteurl like "dpincoli.com" or domainname like "toplinebuy.com" or url like "toplinebuy.com" or siteurl like "toplinebuy.com" or domainname like "5200m.com" or url like "5200m.com" or siteurl like "5200m.com" or domainname like "6662nyde.acs-wcst.com" or url like "6662nyde.acs-wcst.com" or siteurl like "6662nyde.acs-wcst.com" or domainname like "eccentric-authentication.com" or url like "eccentric-authentication.com" or siteurl like "eccentric-authentication.com" or domainname like "canacedesotogroup.com" or url like "canacedesotogroup.com" or siteurl like "canacedesotogroup.com" or domainname like "noxband.com" or url like "noxband.com" or siteurl like "noxband.com" or domainname like "paulecosconnect.com" or url like "paulecosconnect.com" or siteurl like "paulecosconnect.com" or domainname like "payapp.auth.outlook2026common.copilos26.bettylnc.com" or url like "payapp.auth.outlook2026common.copilos26.bettylnc.com" or siteurl like "payapp.auth.outlook2026common.copilos26.bettylnc.com" or domainname like "clingard.pro" or url like "clingard.pro" or siteurl like "clingard.pro" or domainname like "dutchfarrms.com" or url like "dutchfarrms.com" or siteurl like "dutchfarrms.com" or domainname like "efaxdoc.auth.outlook2026common.copilos26.bettylnc.com" or url like "efaxdoc.auth.outlook2026common.copilos26.bettylnc.com" or siteurl like "efaxdoc.auth.outlook2026common.copilos26.bettylnc.com" or domainname like "6695lkmo.prefform.us" or url like "6695lkmo.prefform.us" or siteurl like "6695lkmo.prefform.us" or domainname like "thewiginton.com" or url like "thewiginton.com" or siteurl like "thewiginton.com" or domainname like "shared.paymentsclouds.statementsapproved.jetbusinesscapltal.com" or url like "shared.paymentsclouds.statementsapproved.jetbusinesscapltal.com" or siteurl like "shared.paymentsclouds.statementsapproved.jetbusinesscapltal.com" or domainname like "slybee.com" or url like "slybee.com" or siteurl like "slybee.com" or domainname like "auth.login.office365.cloud.onedrive.outlook.atlarchitacts.com" or url like "auth.login.office365.cloud.onedrive.outlook.atlarchitacts.com" or siteurl like "auth.login.office365.cloud.onedrive.outlook.atlarchitacts.com" or domainname like "ecosys.newdocument2026.pdfdocshared.tntileandmarbleinc.com" or url like "ecosys.newdocument2026.pdfdocshared.tntileandmarbleinc.com" or siteurl like "ecosys.newdocument2026.pdfdocshared.tntileandmarbleinc.com" or domainname like "docshare.auth.copilot.outlookonedrive.common.northemheating.com" or url like "docshare.auth.copilot.outlookonedrive.common.northemheating.com" or siteurl like "docshare.auth.copilot.outlookonedrive.common.northemheating.com" or domainname like "lampadasdeslgn.com" or url like "lampadasdeslgn.com" or siteurl like "lampadasdeslgn.com" or domainname like "detroitgardenswork.com" or url like "detroitgardenswork.com" or siteurl like "detroitgardenswork.com" or domainname like "metlarnelaw.com" or url like "metlarnelaw.com" or siteurl like "metlarnelaw.com" or domainname like "snk-s.org" or url like "snk-s.org" or siteurl like "snk-s.org" or domainname like "priorispace.biz" or url like "priorispace.biz" or siteurl like "priorispace.biz" or domainname like "coreansdmain.com" or url like "coreansdmain.com" or siteurl like "coreansdmain.com" or domainname like "bigbrain.chickenkiller.com" or url like "bigbrain.chickenkiller.com" or siteurl like "bigbrain.chickenkiller.com" or domainname like "seatacsmarine.com" or url like "seatacsmarine.com" or siteurl like "seatacsmarine.com" or domainname like "sdocshares.auth.outlook2026common.copilos26.csr-rooflng.com" or url like "sdocshares.auth.outlook2026common.copilos26.csr-rooflng.com" or siteurl like "sdocshares.auth.outlook2026common.copilos26.csr-rooflng.com" or domainname like "0350pvas.acs-wcst.com" or url like "0350pvas.acs-wcst.com" or siteurl like "0350pvas.acs-wcst.com" or domainname like "copilots.outlook.cloud.microsoft.syrosconstructlon.com" or url like "copilots.outlook.cloud.microsoft.syrosconstructlon.com" or siteurl like "copilots.outlook.cloud.microsoft.syrosconstructlon.com" or domainname like "caine-wenier.com" or url like "caine-wenier.com" or siteurl like "caine-wenier.com" or domainname like "efaxdoc.documents2026.cmc.docs.shared.matchlinemechanicallc.com" or url like "efaxdoc.documents2026.cmc.docs.shared.matchlinemechanicallc.com" or siteurl like "efaxdoc.documents2026.cmc.docs.shared.matchlinemechanicallc.com" or domainname like "sdocshares.auth.outlook.copilos26.general.csr-rooflng.com" or url like "sdocshares.auth.outlook.copilos26.general.csr-rooflng.com" or siteurl like "sdocshares.auth.outlook.copilos26.general.csr-rooflng.com" or domainname like "whitfillsnursery.com" or url like "whitfillsnursery.com" or siteurl like "whitfillsnursery.com" or domainname like "bxcelcounselling.org" or url like "bxcelcounselling.org" or siteurl like "bxcelcounselling.org" or domainname like "auth-loadingdocuments.online" or url like "auth-loadingdocuments.online" or siteurl like "auth-loadingdocuments.online" or domainname like "gregor.justdied.com" or url like "gregor.justdied.com" or siteurl like "gregor.justdied.com" or domainname like "tentkit.com" or url like "tentkit.com" or siteurl like "tentkit.com" or domainname like "plusoptlx.com" or url like "plusoptlx.com" or siteurl like "plusoptlx.com" or domainname like "rubinsrudman.com" or url like "rubinsrudman.com" or siteurl like "rubinsrudman.com" or domainname like "flow55.chickenkiller.com" or url like "flow55.chickenkiller.com" or siteurl like "flow55.chickenkiller.com" or domainname like "glafondbottamconstruction.com" or url like "glafondbottamconstruction.com" or siteurl like "glafondbottamconstruction.com" or domainname like "haevy-llc.com" or url like "haevy-llc.com" or siteurl like "haevy-llc.com" or domainname like "maqaigiapelhani.cam" or url like "maqaigiapelhani.cam" or siteurl like "maqaigiapelhani.cam" or domainname like "psionicsandhorses.net" or url like "psionicsandhorses.net" or siteurl like "psionicsandhorses.net" or domainname like "kuer.online" or url like "kuer.online" or siteurl like "kuer.online" or domainname like "eurosforgroup.com" or url like "eurosforgroup.com" or siteurl like "eurosforgroup.com" or domainname like "pdfdocshared.auth.outlook2026common.copilos26.ikextal-co-kr.com" or url like "pdfdocshared.auth.outlook2026common.copilos26.ikextal-co-kr.com" or siteurl like "pdfdocshared.auth.outlook2026common.copilos26.ikextal-co-kr.com" or domainname like "vasquezmyth.com" or url like "vasquezmyth.com" or siteurl like "vasquezmyth.com" or domainname like "celestialtremor.org" or url like "celestialtremor.org" or siteurl like "celestialtremor.org" or domainname like "reauth.copilot.common.outlook.mcloud365.atlarchitacts.com" or url like "reauth.copilot.common.outlook.mcloud365.atlarchitacts.com" or siteurl like "reauth.copilot.common.outlook.mcloud365.atlarchitacts.com" or domainname like "atlantictriad.ignorelist.com" or url like "atlantictriad.ignorelist.com" or siteurl like "atlantictriad.ignorelist.com" or domainname like "lionheartsecurityservice.com" or url like "lionheartsecurityservice.com" or siteurl like "lionheartsecurityservice.com" or domainname like "stellarntis-fs.com" or url like "stellarntis-fs.com" or siteurl like "stellarntis-fs.com" or domainname like "atlassgroupinc.com" or url like "atlassgroupinc.com" or siteurl like "atlassgroupinc.com" or domainname like "gcotoncovingtoncontracting.com" or url like "gcotoncovingtoncontracting.com" or siteurl like "gcotoncovingtoncontracting.com" or domainname like "bramum.online" or url like "bramum.online" or siteurl like "bramum.online" or domainname like "linogomes-pt.cc" or url like "linogomes-pt.cc" or siteurl like "linogomes-pt.cc" or domainname like "jjnysnobiogtx.org" or url like "jjnysnobiogtx.org" or siteurl like "jjnysnobiogtx.org" or domainname like "docshare.auth.copilot.outlook.onedrive.common.northemheating.com" or url like "docshare.auth.copilot.outlook.onedrive.common.northemheating.com" or siteurl like "docshare.auth.copilot.outlook.onedrive.common.northemheating.com" or domainname like "outlookdrive.microsoftonline.common.oauth2.client.buycerm.com" or url like "outlookdrive.microsoftonline.common.oauth2.client.buycerm.com" or siteurl like "outlookdrive.microsoftonline.common.oauth2.client.buycerm.com" or domainname like "ideahom.world" or url like "ideahom.world" or siteurl like "ideahom.world" or domainname like "acrobat-adobe-com-4464uswc.egllo.com" or url like "acrobat-adobe-com-4464uswc.egllo.com" or siteurl like "acrobat-adobe-com-4464uswc.egllo.com" or domainname like "pdocshared.payments2026.outlooks.common.ecmholdlnggroup.com" or url like "pdocshared.payments2026.outlooks.common.ecmholdlnggroup.com" or siteurl like "pdocshared.payments2026.outlooks.common.ecmholdlnggroup.com" or domainname like "lawyer.cuztools.com" or url like "lawyer.cuztools.com" or siteurl like "lawyer.cuztools.com" or domainname like "rapid-scale.net" or url like "rapid-scale.net" or siteurl like "rapid-scale.net" or domainname like "apexpartsdepot.com" or url like "apexpartsdepot.com" or siteurl like "apexpartsdepot.com" or domainname like "0utlook0ffice365admin.twilightparadox.com" or url like "0utlook0ffice365admin.twilightparadox.com" or siteurl like "0utlook0ffice365admin.twilightparadox.com" or domainname like "docshare.auth.copilot.outlook.onedrive.common0.evergreenerg.com" or url like "docshare.auth.copilot.outlook.onedrive.common0.evergreenerg.com" or siteurl like "docshare.auth.copilot.outlook.onedrive.common0.evergreenerg.com" or domainname like "login.microsoft365.outlook.copilotsoffice365.lntactpr.com" or url like "login.microsoft365.outlook.copilotsoffice365.lntactpr.com" or siteurl like "login.microsoft365.outlook.copilotsoffice365.lntactpr.com" or domainname like "nicewayrealestate.cc" or url like "nicewayrealestate.cc" or siteurl like "nicewayrealestate.cc" or domainname like "westlakeproduces.com" or url like "westlakeproduces.com" or siteurl like "westlakeproduces.com" or domainname like "wsochares.authpayments.common.paid2026.bullochdirtwroks.com" or url like "wsochares.authpayments.common.paid2026.bullochdirtwroks.com" or siteurl like "wsochares.authpayments.common.paid2026.bullochdirtwroks.com" or domainname like "docshare.auth.copilot.outlook.onedrive.common.earthlink-net.com" or url like "docshare.auth.copilot.outlook.onedrive.common.earthlink-net.com" or siteurl like "docshare.auth.copilot.outlook.onedrive.common.earthlink-net.com" or domainname like "reauth.copilot.auth.outlook.mcloud365.buycerm.com" or url like "reauth.copilot.auth.outlook.mcloud365.buycerm.com" or siteurl like "reauth.copilot.auth.outlook.mcloud365.buycerm.com" or domainname like "dguidrycardinazprofessional.com" or url like "dguidrycardinazprofessional.com" or siteurl like "dguidrycardinazprofessional.com" or domainname like "frontdesk.click" or url like "frontdesk.click" or siteurl like "frontdesk.click" or domainname like "calebchemicals.com" or url like "calebchemicals.com" or siteurl like "calebchemicals.com" or domainname like "studeseliamechan.link" or url like "studeseliamechan.link" or siteurl like "studeseliamechan.link" or domainname like "mgproparties.com" or url like "mgproparties.com" or siteurl like "mgproparties.com" or domainname like "0ff365access.mooo.com" or url like "0ff365access.mooo.com" or siteurl like "0ff365access.mooo.com" or domainname like "bloomfleldcapital.com" or url like "bloomfleldcapital.com" or siteurl like "bloomfleldcapital.com" or domainname like "statement.outlookoffice365.microsoftcopilots.calmechc.net" or url like "statement.outlookoffice365.microsoftcopilots.calmechc.net" or siteurl like "statement.outlookoffice365.microsoftcopilots.calmechc.net" or domainname like "grincool.xyz" or url like "grincool.xyz" or siteurl like "grincool.xyz" or domainname like "m365cloud.login.outlook.office365.azgymfloor.com" or url like "m365cloud.login.outlook.office365.azgymfloor.com" or siteurl like "m365cloud.login.outlook.office365.azgymfloor.com" or domainname like "kilishy.qhigh.com" or url like "kilishy.qhigh.com" or siteurl like "kilishy.qhigh.com" or domainname like "awemode.outlookoffice365.microsoftcopilots.docshare.linnwest.us" or url like "awemode.outlookoffice365.microsoftcopilots.docshare.linnwest.us" or siteurl like "awemode.outlookoffice365.microsoftcopilots.docshare.linnwest.us" or domainname like "5375jngu.prefform.us" or url like "5375jngu.prefform.us" or siteurl like "5375jngu.prefform.us" or domainname like "login.office365outlooks.microsoft.cloud-outlook.naregruop.com" or url like "login.office365outlooks.microsoft.cloud-outlook.naregruop.com" or siteurl like "login.office365outlooks.microsoft.cloud-outlook.naregruop.com" or domainname like "metrorocl.co.uk" or url like "metrorocl.co.uk" or siteurl like "metrorocl.co.uk" or domainname like "docshare.auth2026.onedrive.outlooksdocument.csr-rooflng.com" or url like "docshare.auth2026.onedrive.outlooksdocument.csr-rooflng.com" or siteurl like "docshare.auth2026.onedrive.outlooksdocument.csr-rooflng.com" or domainname like "swiftii.chickenkiller.com" or url like "swiftii.chickenkiller.com" or siteurl like "swiftii.chickenkiller.com" or domainname like "innvisoin.net" or url like "innvisoin.net" or siteurl like "innvisoin.net" or domainname like "efaxdoc.auth.outlook2026common.copilos26.kone-inc.com" or url like "efaxdoc.auth.outlook2026common.copilos26.kone-inc.com" or siteurl like "efaxdoc.auth.outlook2026common.copilos26.kone-inc.com" or domainname like "photosofus.com" or url like "photosofus.com" or siteurl like "photosofus.com" or domainname like "insigthinvestments.com" or url like "insigthinvestments.com" or siteurl like "insigthinvestments.com" or domainname like "rustlnsurance.com" or url like "rustlnsurance.com" or siteurl like "rustlnsurance.com" or domainname like "efaxdoc.documents2026.docs.shared.lakeviewscustom.com" or url like "efaxdoc.documents2026.docs.shared.lakeviewscustom.com" or siteurl like "efaxdoc.documents2026.docs.shared.lakeviewscustom.com" or domainname like "apinows.com" or url like "apinows.com" or siteurl like "apinows.com" or domainname like "albertamo.com" or url like "albertamo.com" or siteurl like "albertamo.com" or domainname like "docshares.auth2026.outlookcommon.copilots.commm.csr-rooflng.com" or url like "docshares.auth2026.outlookcommon.copilots.commm.csr-rooflng.com" or siteurl like "docshares.auth2026.outlookcommon.copilots.commm.csr-rooflng.com" or domainname like "authorize.copilot.outlook.common.microsoft0365.atlarchitacts.com" or url like "authorize.copilot.outlook.common.microsoft0365.atlarchitacts.com" or siteurl like "authorize.copilot.outlook.common.microsoft0365.atlarchitacts.com" or domainname like "fosterswifts.com" or url like "fosterswifts.com" or siteurl like "fosterswifts.com" or domainname like "lifetimeroofsystem.net" or url like "lifetimeroofsystem.net" or siteurl like "lifetimeroofsystem.net" or domainname like "sdocshares.authoutlooks.common.copilots2026.hathormson.com" or url like "sdocshares.authoutlooks.common.copilots2026.hathormson.com" or siteurl like "sdocshares.authoutlooks.common.copilots2026.hathormson.com" or domainname like "bezpartien.online" or url like "bezpartien.online" or siteurl like "bezpartien.online" or domainname like "7criccasinobonus.cc" or url like "7criccasinobonus.cc" or siteurl like "7criccasinobonus.cc" or domainname like "ctr-wooding.com" or url like "ctr-wooding.com" or siteurl like "ctr-wooding.com" or domainname like "devtachsales.com" or url like "devtachsales.com" or siteurl like "devtachsales.com" or domainname like "clubdenut.club" or url like "clubdenut.club" or siteurl like "clubdenut.club" or domainname like "copilots.outlook.cloud.microsoft.andersonelevators.com" or url like "copilots.outlook.cloud.microsoft.andersonelevators.com" or siteurl like "copilots.outlook.cloud.microsoft.andersonelevators.com" or domainname like "naregruop.com" or url like "naregruop.com" or siteurl like "naregruop.com" or domainname like "7301eqny.acs-wcst.com" or url like "7301eqny.acs-wcst.com" or siteurl like "7301eqny.acs-wcst.com" or domainname like "bandg-electrics.com" or url like "bandg-electrics.com" or siteurl like "bandg-electrics.com" or domainname like "buckslu.org" or url like "buckslu.org" or siteurl like "buckslu.org" or domainname like "solutions00fileptroduct.com" or url like "solutions00fileptroduct.com" or siteurl like "solutions00fileptroduct.com" or domainname like "sunraycontractlng.com" or url like "sunraycontractlng.com" or siteurl like "sunraycontractlng.com" or domainname like "advancedsteelbuilding.com" or url like "advancedsteelbuilding.com" or siteurl like "advancedsteelbuilding.com" or domainname like "hcnyecom.com" or url like "hcnyecom.com" or siteurl like "hcnyecom.com"

    Reference

    SkyW4lker Phishing Campaign                                                              


    Tags

    MalwarePhishingStealerMicrosoftUnited StatesIndiaCanadaUnited Kingdom

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags