Threat Summary
Two live OTX pulses published on 2026-10-27 reveal converging threats against identity infrastructure and payment pipelines.
Pulse 1 — SkyW4lker Phishing Kit (with Gabagool tooling): An active device-code phishing kit operating since June 2026 that exploits the Microsoft 365 OAuth 2.0 device authorization grant flow (RFC 8628). Rather than stealing passwords, the kit tricks victims into entering attacker-generated device codes on legitimate Microsoft login pages — a technique that completely bypasses MFA because the victim authenticates through Microsoft's real infrastructure and the attacker harvests the resulting session token. Targeted verticals include Technology, Manufacturing, and Government across the US, UK, Canada, and India. Lures arrive as phishing emails with password-protected attachments containing malicious links — a classic anti-sandbox evasion.
Pulse 2 — Brazilian Magecart Convertr/Plausible Supply Chain Attack (CVE-2026-8467): A Brazilian Magecart group active since 2024 compromised the Plausible analytics script served from analytics.convertr.app.br, injecting a card skimmer into every Convertr checkout page starting 2026-10-24. The skimmer exfiltrates full cardholder data — PAN, CVV, expiry, cardholder name, and Brazilian CPF taxpayer numbers — to attacker-controlled infrastructure including 1x0.is/ws. This is a textbook supply-chain compromise: one trusted third-party script poisoned the entire payment surface.
Collective picture: Both campaigns share a common theme — abuse of trusted legitimate services (Microsoft OAuth endpoints, third-party analytics scripts) to defeat perimeter controls and MFA. Neither relies on dropping traditional malware; both operate in the identity and browser layers where legacy AV is blind.
Threat Actor / Malware Profile
SkyW4lker + Gabagool
- Attribution: Unknown operator; kit sold/distributed in criminal communities. The
obfuscator.ioindicator suggests the phishing kit's JavaScript is protected with commercial-grade obfuscation. - Distribution: Phishing emails with password-protected attachments (passwords supplied in the email body) containing links to kit-hosted lure pages on domains like
fosterswifts.com,kuer.online,off365mail.club, andeccentric-authentication.com. - Attack chain: Lure page initiates an OAuth 2.0 device-code flow against Microsoft's real
login.microsoftonline.com→ victim is shown a legitimate Microsoft device-code prompt → victim enters the attacker-supplied code and authenticates (with MFA) → attacker polls the token endpoint and receives valid access/refresh tokens → full mailbox and M365 session takeover without ever touching the password. - Payload behavior (Gabagool): Post-compromise tooling associated with the kit used for token replay, mailbox enumeration, and inbox rule creation for persistence and BEC staging.
- Persistence: OAuth refresh tokens survive password resets; attackers typically add malicious inbox rules and may register additional MFA methods on the account.
- Anti-analysis: Password-protected attachments defeat automated detonation; JavaScript obfuscation via obfuscator.io defeats static analysis; use of first-party Microsoft endpoints defeats domain reputation controls.
Brazilian Magecart Group
- Attribution: Brazilian Magecart cluster active since 2024; consistent with long-running Latin American skimming crews targeting domestic ecommerce.
- Distribution: Supply-chain injection into the Plausible analytics JavaScript served by Convertr (
analytics.convertr.app.br), exploiting CVE-2026-8467. - Payload behavior: Skimmer hooking checkout form fields; harvests PAN, CVV, expiry, name, and CPF; exfiltrates over WebSocket-style endpoints (
https://1x0.is/ws) to blend with legitimate analytics beacons. Additional staging/exfil domains includeecomscan.com,antiddos-protection.net, anddeepveindrilling.com. - Persistence: Lives entirely in the third-party script — no server-side artifact on merchant infrastructure; persists as long as the poisoned script remains served.
- Anti-analysis: Conditional execution (activates only on checkout pages), benign-looking exfil endpoints, and script integrity that changes dynamically to defeat static scanning.
IOC Analysis
Indicator composition across both pulses:
- Domains (primary): Phishing kit infrastructure (
fosterswifts.com,off365mail.club,eccentric-authentication.com,kuer.online,mouphyweb.com,photosofus.com,nicewayrealestate.cc) and skimmer exfil/staging (1x0.is,ecomscan.com,antiddos-protection.net,deepveindrilling.com). Noteobfuscator.iois a legitimate obfuscation service abused by the kit — block at proxy level for non-developer user populations. - URLs:
http(s)://1x0.is/ws— skimmer exfiltration endpoint; match on full URI path, not just host. - FileHash-SHA256:
ee4618d24737eff785e5a267b55903d5ef6ff7ecbeb099347a67fee77734d7f7— skimmer script sample; useful for retro-hunting in proxy caches and CDN logs. - CVE: CVE-2026-8467 — the Convertr/Plausible injection vector; relevant for any org running similar self-hosted analytics.
Operationalization guidance:
- Push all domains/URLs to DNS sinkhole, web proxy, and EDR network-blocking lists immediately.
- For SkyW4lker, domain blocking alone is insufficient — the token theft happens on Microsoft's domains. Detection must focus on anomalous device-code flow usage in Entra ID sign-in logs.
- For Magecart, merchants should implement Subresource Integrity (SRI) and Content Security Policy (CSP) with strict script-src; run client-side skimmer detection (e.g., DOM mutation monitoring on checkout forms).
- Tooling: CyberChef for deobfuscating kit JavaScript, urlscan.io/ANY.RUN for detonating lure pages, Sigma + Sentinel for log-side detection.
Detection Engineering
YAML
---
title: Microsoft 365 OAuth Device Code Flow Authentication Anomaly
description: Detects device authorization grant sign-ins consistent with SkyW4lker kit token theft, especially from unusual geographies or for users who never use device-code flows
tags:
- attack.initial_access
- attack.t1528
- attack.t1550.001
- skyw4lker
logsource:
product: azure
service: signinlogs
detection:
selection:
AuthenticationProtocol: 'deviceCode'
filter_known:
DeviceDetail.browser: 'Broker'
condition: selection and not filter_known
falsepositives:
- Legitimate device-code auth on TVs, kiosks, IoT devices
level: high
date: 2026/10/28
---
title: Phishing Email With Password Protected Attachment Containing Link
description: Detects execution chain where user opens password-protected archive attachment then launches browser — consistent with SkyW4lker lure delivery
tags:
- attack.initial_access
- attack.t1566.001
logsource:
category: process_creation
product: windows
detection:
selection_browser:
Image|endswith:
- '\chrome.exe'
- '\msedge.exe'
- '\firefox.exe'
selection_cli:
CommandLine|contains:
- 'fosterswifts.com'
- 'off365mail.club'
- 'eccentric-authentication.com'
- 'kuer.online'
- 'mouphyweb.com'
- 'nicewayrealestate.cc'
condition: selection_browser and selection_cli
level: critical
date: 2026/10/28
---
title: Magecart Skimmer Exfiltration Network Connection
description: Detects outbound connections to known Magecart skimmer exfiltration infrastructure from the Convertr/Plausible supply-chain campaign
tags:
- attack.exfiltration
- attack.collection
- attack.t1189
- attack.t1041
- magecart
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationHostname|contains:
- '1x0.is'
- 'ecomscan.com'
- 'antiddos-protection.net'
- 'deepveindrilling.com'
condition: selection
level: critical
date: 2026/10/28
KQL — Microsoft Sentinel / Defender
// Hunt: SkyW4lker device-code phishing + Magecart exfil infrastructure
// Microsoft Sentinel — combines identity-layer and network-layer hunting
// Part 1: Network connections to IOC infrastructure (both pulses)
let PhishingDomains = dynamic(["fosterswifts.com","off365mail.club","eccentric-authentication.com","kuer.online","mouphyweb.com","photosofus.com","nicewayrealestate.cc"]);
let SkimmerDomains = dynamic(["1x0.is","ecomscan.com","antiddos-protection.net","deepveindrilling.com"]);
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (PhishingDomains) or RemoteUrl has_any (SkimmerDomains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType
| extend HitType = iff(RemoteUrl has_any (SkimmerDomains), "Magecart Exfil", "Phishing Kit C2");
NetworkHits
| union (
// Part 2: Browser processes launched with phishing URLs (device-code lure click-through)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("chrome.exe","msedge.exe","firefox.exe")
| where ProcessCommandLine has_any (PhishingDomains)
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName
| extend HitType = "Phishing Lure Click"
)
| order by TimeGenerated desc;
// Part 3 (run separately with IdentityLogonEvents or via Entra connector):
// Hunt device-code grant sign-ins — the core SkyW4lker signal
SigninLogs
| where TimeGenerated > ago(14d)
| where AuthenticationProtocol == "deviceCode"
| summarize SignInCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
Locations = make_set(Location), IPs = make_set(IPAddress), Apps = make_set(AppDisplayName)
by UserPrincipalName
| extend RiskScore = SignInCount * array_length(Locations)
| order by RiskScore desc;
PowerShell
# SkyW4lker + Magecart IOC Hunt Script
# Run via EDR remote shell or Intune proactive remediation across fleet
# Checks: network connections, browser cache artifacts, inbox rule artifacts, DNS cache
$PhishingDomains = @("fosterswifts.com","off365mail.club","eccentric-authentication.com","kuer.online","mouphyweb.com","photosofus.com","nicewayrealestate.cc","obfuscator.io")
$SkimmerIOCs = @("1x0.is","ecomscan.com","antiddos-protection.net","deepveindrilling.com")
$SkimmerHash = "ee4618d24737eff785e5a267b55903d5ef6ff7ecbeb099347a67fee77734d7f7"
$AllIOCs = $PhishingDomains + $SkimmerIOCs
$findings = @()
Write-Host "[+] Checking active/historical TCP connections..." -ForegroundColor Cyan
Get-NetTCPConnection | Where-Object { $_.State -eq "Established" } | ForEach-Object {
try {
$rdns = (Resolve-DnsName -Name $_.RemoteAddress -ErrorAction Stop).NameHost
foreach ($ioc in $AllIOCs) {
if ($rdns -like "*$ioc*") {
$findings += "NETWORK: $($_.RemoteAddress) [$rdns] PID $($_.OwningProcess) matched $ioc"
}
}
} catch {}
}
Write-Host "[+] Checking DNS resolver cache for IOC lookups..." -ForegroundColor Cyan
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($entry in $dnsCache) {
foreach ($ioc in $AllIOCs) {
if ($entry.Entry -like "*$ioc*") {
$findings += "DNS CACHE: $($entry.Entry) -> $($entry.Data) matched $ioc"
}
}
}
Write-Host "[+] Checking browser history/cache files for lure and skimmer domains..." -ForegroundColor Cyan
$browserPaths = @(
"$env:LOCALAPPDATA\Google\Chrome\User Data\Default\History",
"$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\History"
)
foreach ($bp in $browserPaths) {
if (Test-Path $bp) {
$raw = Get-Content $bp -Raw -ErrorAction SilentlyContinue
foreach ($ioc in $AllIOCs) {
if ($raw -match [regex]::Escape($ioc)) {
$findings += "BROWSER HISTORY: $ioc found in $bp"
}
}
}
}
Write-Host "[+] Scanning downloads/temp for skimmer hash or password-protected archives..." -ForegroundColor Cyan
$scanDirs = @("$env:USERPROFILE\Downloads", "$env:TEMP")
foreach ($dir in $scanDirs) {
Get-ChildItem $dir -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
$h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
if ($h -eq $SkimmerHash) {
$findings += "FILE HASH MATCH (Magecart skimmer): $($_.FullName)"
}
}
}
Write-Host "[+] Checking for suspicious OAuth consent / recent mailbox audit flags..." -ForegroundColor Cyan
# Note: full mailbox rule review requires Exchange Online PowerShell:
# Get-InboxRule -Mailbox <user> | Where-Object { $_.RedirectTo -ne $null -or $_.DeleteMessage -eq $true }
if ($findings.Count -gt 0) {
Write-Host "[!] FINDINGS DETECTED:" -ForegroundColor Red
$findings | ForEach-Object { Write-Host " $_" -ForegroundColor Yellow }
$findings | Out-File "$env:TEMP\otx_hunt_findings_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"
} else {
Write-Host "[OK] No IOC matches found on this host." -ForegroundColor Green
}
Response Priorities
Immediate (0-4 hours):
- Block all phishing kit and skimmer domains/URLs at DNS, proxy, and EDR network layers; add
1x0.is/wsfull-URI match to egress filtering. - Hunt Entra ID sign-in logs for any
deviceCodeauthentication protocol usage in the last 30 days — any hit on a standard knowledge worker is presumptively malicious. - Revoke all refresh tokens for any user with device-code sign-in anomalies:
Revoke-MgUserSignInSessionand force re-registration of MFA methods. - If your org processes ecommerce payments, verify no third-party analytics scripts load on checkout pages without SRI hashes.
24 Hours:
- Full identity verification for any account with device-code flow activity: review inbox rules for forwarding/redirect rules (BEC staging), audit OAuth app consents, check for newly registered MFA devices, and review mailbox audit logs for mass read/export activity consistent with Gabagool tooling.
- For retail/payment teams: retro-hunt CDN and proxy logs for the skimmer SHA256 and
1x0.isconnections; assess PCI-DSS breach notification obligations if any checkout traffic traversed compromised scripts (CPF + PAN exposure triggers LGPD notification in Brazil). - Rotate credentials for any user who may have entered a device code; assume session tokens, not passwords, are the stolen asset.
1 Week:
- Architectural hardening: Disable the device-code OAuth grant flow tenant-wide in Entra ID unless there is a documented business need (Conditional Access policy blocking
deviceCodeflow). This single control kills the entire SkyW4lker technique. - Implement Subresource Integrity + strict CSP on all payment/checkout pages; deploy client-side script integrity monitoring (e.g., continuous JS diffing of third-party tags).
- Move to phishing-resistant authentication (FIDO2/passkeys) — device-code phishing defeats TOTP and push MFA, but not hardware-bound passkeys.
- Add email gateway rules quarantining password-protected attachments containing URLs, and deploy the Sigma/Sentinel detections above into production with 14-day lookback baselines.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.