SkyW4lker Device-Code Phishing Kit + Poseidon RAT AI Harness Takeover: OTX Pulse Analysis — Enterprise Detection Pack

Threat Summary

Three concurrent OTX pulses published 2026-10-27 paint a coherent picture: credential and secrets theft at scale is being industrialized across two distinct but complementary fronts — human identity (Microsoft 365 / OAuth) and machine identity (AI agent infrastructure and API keys).

Front 1 — SkyW4lker phishing kit (active since June 2026): An unknown actor is operating a device-code phishing kit that abuses the legitimate OAuth 2.0 device authorization grant flow against Microsoft 365 tenants. Rather than stealing passwords, the kit tricks victims into completing a real Microsoft device-code sign-in, handing the attacker a valid access/refresh token pair — which bypasses MFA entirely because MFA is satisfied during the legitimate flow. Lures arrive as phishing emails with password-protected attachments, targeting technology, manufacturing, and government organizations across the US, UK, Canada, and India. A related toolkit, Gabagool, appears in the same pulse cluster, suggesting shared infrastructure or kit bundling on cybercrime marketplaces.

Front 2 — Automated subversion of Cairn AI pentesting harnesses (active since ~October 20, 2026): Unknown actors are running fully automated campaigns that discover and compromise exposed Cairn AI intrusion-testing harnesses. Malicious tasks are injected that manipulate the AI agents themselves into compromising their own hosts: profiling the installation, harvesting secrets including AI model API keys, downloading the Poseidon RAT, and installing unauthorized SSH keys. This is agentic-operation abuse — the AI tool is weaponized as the execution proxy.

Front 3 — Fake bid invitation credential phishing: A parallel social engineering campaign uses 'Project Bid Invitation' emails with password-protected PDF attachments (evading sandbox detonation), fake OneDrive buttons, and spoofed Microsoft login pages with per-victim URL parameters (?email=, ?key=) for pre-filled, convincing credential harvesting.

Collective objective: harvest identity material — OAuth tokens, M365 credentials, SSH keys, cloud/AI API keys — that can be monetized directly or resold as initial access. The common tradecraft threads are MFA bypass via token theft (not password theft), password-protected attachments to blind scanners, and abuse of trusted Microsoft branding and legitimate authentication flows.

Threat Actor / Malware Profile

SkyW4lker Phishing Kit (+ Gabagool)

• Attribution: Unknown actor; kit-based operation consistent with PhaaS (Phishing-as-a-Service) distribution. Active since June 2026.
• Distribution: Phishing emails carrying password-protected attachments that link victims into a device-code flow. Password protection defeats automated attachment analysis; the kit then walks the victim through what appears to be a legitimate Microsoft sign-in.
• Payload behavior: No traditional malware payload. The 'payload' is a valid OAuth token. The attacker initiates a device authorization request, the victim enters the code at the genuine Microsoft device login endpoint, and the attacker polls the token endpoint to retrieve access and refresh tokens for the victim's account.
• C2 / infrastructure: Phishing and relay domains including fosterswifts.com, kuer.online, mouphyweb.com, off365mail.club, eccentric-authentication.com, photosofus.com, nicewayrealestate.cc; kit code obfuscation via obfuscator.io.
• Persistence: Refresh tokens provide durable access surviving password resets in many configurations; conditional access and token revocation are required to evict.
• Anti-analysis: Obfuscated JavaScript, password-gated lure content, legitimate Microsoft endpoints doing the 'heavy lifting' so network telemetry looks benign.

Poseidon RAT (AI Harness Campaign)

• Distribution: Automated injection of malicious tasks into internet-exposed, unauthenticated Cairn AI pentesting harnesses; the agent is manipulated into fetching and executing the RAT.
• Payload behavior: Host profiling, secrets harvesting (including AI model API keys), download/execute staging from C2, container escape attempts.
• C2 communication: HTTP callback infrastructure at 199.91.220.129:28471 (observed endpoint /worker-health), secondary infrastructure 103.181.134.12.
• Persistence: Installation of unauthorized SSH keys into authorized_keys files — durable, credential-independent access.
• Anti-analysis: Delivery is 'living off the agent' — execution chains originate from a legitimate, often allow-listed AI process, blending malicious activity into expected harness behavior.

Fake Bid / Protected PDF Phishing

• Distribution: 'Project Bid Invitation' emails with password-protected PDFs; fake OneDrive buttons redirect to fraudulent document drives.
• Infrastructure: Subdomain abuse under lastingonlineexperiences.de (e.g., nbpn., mm-lasertechnik.) and credential-harvest endpoints on slotpastimaxwin50jt.online; per-victim tracking via URL query parameters.
• Anti-analysis: Password-protected PDFs cannot be detonated by sandboxes without the password; gambling-themed TLD hosting rotates quickly.

IOC Analysis

The pulse indicator set spans four operational types, each mapped to a distinct control plane:

Key tooling notes: URLs with embedded victim emails/keys should be decoded (URL-decode + base64 where applicable) to identify which users were targeted — that list is your forced-reset roster. The /worker-health endpoint indicates a botnet-style check-in protocol; periodic beaconing to non-standard port 28471 is highly anomalous in enterprise egress. Hash pivots through your sandbox of choice (the reference analysis was published via ANY.RUN) will yield additional config and C2 extraction.

Detection Engineering

---
title: OAuth Device Code Flow Authentication Anomaly - SkyW4lker Kit
description: Detects device-code grant authentication to Microsoft 365 from anomalous sources. SkyW4lker abuses the OAuth 2.0 device authorization flow to capture tokens without passwords, bypassing MFA. Legitimate device-code usage is rare in most enterprises.
id: 8f3a1c2e-5b7d-4e91-a2f4-9c1d3e5a7b01
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/10/28
logsource:
  product: azure
  service: signinlogs
detection:
  selection_flow:
    authentication_protocol: 'deviceCode'
  selection_anomaly:
    risk_level: 'high'
  filter_known:
    device_detail|contains: 'known'
  condition: selection_flow and not filter_known
level: high
tags:
  - attack.t1528
  - attack.t1550
  - attack.t1566
falsepositives:
  - Legitimate device-code sign-ins from kiosks, Teams room devices, or CLI tooling
---
title: Network Connection to Poseidon RAT C2 Infrastructure
description: Detects outbound connections to Poseidon RAT command-and-control infrastructure observed in automated AI harness takeover campaigns, including the /worker-health check-in endpoint on port 28471.
id: 2d7b9e41-6c3a-4f82-b1e5-8a4c6d2f9e33
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/10/28
logsource:
  category: network_connection
detection:
  selection_ip:
    DestinationIp:
      - '199.91.220.129'
      - '103.181.134.12'
  selection_port:
    DestinationPort: 28471
  condition: 1 of selection_*
level: critical
tags:
  - attack.t1071
  - attack.t1571
falsepositives:
  - None expected in enterprise environments
---
title: Unauthorized SSH Key Installation - Poseidon RAT Persistence
description: Detects modification or creation of SSH authorized_keys files, a persistence mechanism used by the Poseidon RAT campaign after compromising AI pentesting harnesses.
id: 5e1c8a94-3d6f-4a27-c9b2-7e5f1a3b8d44
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/10/28
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|endswith: 'authorized_keys'
  condition: selection
level: high
tags:
  - attack.t1098.004
  - attack.t1059
falsepositives:
  - Legitimate key rotation by administrators or configuration management tooling (Ansible, Chef)

// Hunt: SkyW4lker phishing infrastructure + Poseidon C2 + fake-bid lure domains
let PhishingDomains = dynamic(["fosterswifts.com", "kuer.online", "mouphyweb.com", "off365mail.club", "eccentric-authentication.com", "photosofus.com", "nicewayrealestate.cc", "lastingonlineexperiences.de", "slotpastimaxwin50jt.online"]);
let PoseidonC2 = dynamic(["199.91.220.129", "103.181.134.12"]);
let NetworkHits = DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteUrl has_any (PhishingDomains) or RemoteIP in (PoseidonC2) or (RemotePort == 28471)
    | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, ActionType;
let ProcessHits = DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where SHA256 in ("1cfee868e5e488bb862140cf288fce46a167aa5982900102356dac552fa4fa43", "9ca705d6466d4d71c3fb0cae5097933afe1de1bc139d53bb63565a52dc9ebccb")
       or MD5 in ("7945967abaf6b5977b40f75bf34d631c", "c9281ea6828b9de4443ac56361ac29da")
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, SHA256;
union NetworkHits, ProcessHits
| sort by TimeGenerated desc

# Security Arsenal IOC Hunt — SkyW4lker / Poseidon / Fake-Bid Campaigns
$PoseidonC2 = @('199.91.220.129','103.181.134.12')
$PhishingDomains = @('fosterswifts.com','kuer.online','mouphyweb.com','off365mail.club','eccentric-authentication.com','photosofus.com','nicewayrealestate.cc','lastingonlineexperiences.de','slotpastimaxwin50jt.online')
$BadHashes = @('1cfee868e5e488bb862140cf288fce46a167aa5982900102356dac552fa4fa43','9ca705d6466d4d71c3fb0cae5097933afe1de1bc139d53bb63565a52dc9ebccb')

Write-Host '[*] Checking active/historical network connections to Poseidon C2...'
Get-NetTCPConnection | Where-Object { $PoseidonC2 -contains $_.RemoteAddress -or $_.RemotePort -eq 28471 } | Format-Table LocalAddress,RemoteAddress,RemotePort,State,OwningProcess

Write-Host '[*] Sweeping DNS cache for phishing kit infrastructure...'
Get-DnsClientCache | Where-Object { $d = $_.Entry; $PhishingDomains | Where-Object { $d -like "*$_*" } } | Format-Table Entry,Data

Write-Host '[*] Hunting malicious file hashes in common staging paths...'
Get-ChildItem -Path 'C:\Users','C:\ProgramData','C:\Windows\Temp' -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
    if ($BadHashes -contains (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash) { Write-Host "[!] MALICIOUS FILE: $($_.FullName)" }
}

Write-Host '[*] Auditing SSH authorized_keys for unauthorized persistence (Poseidon TTP)...'
Get-ChildItem -Path 'C:\Users\*\.ssh\authorized_keys','C:\ProgramData\ssh\*' -ErrorAction SilentlyContinue | ForEach-Object { Write-Host "[+] Review keys in: $($_.FullName) (LastWrite: $($_.LastWriteTime))"; Get-Content $_.FullName }

Write-Host '[*] Checking recent downloads of password-protected lure artifacts...'
Get-ChildItem -Path 'C:\Users\*\Downloads' -Include '*.pdf','*.zip','*.html' -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } | Format-Table FullName,LastWriteTime

Response Priorities

Immediate (0–4 hours):

• Block all listed phishing domains and Poseidon C2 IPs at DNS, proxy, and firewall egress; block outbound port 28471 globally.
• Push both SHA256 payloads and the malicious PDF hashes into EDR prevention (not just detection) and retro-hunt 90 days of network telemetry — any Poseidon C2 hit is a confirmed compromise.
• Alert on OAuth device-code authentications tenant-wide; legitimate use is rare and easily baselined.

24 hours:

• This is credential- and token-stealing activity — assume identity compromise. Revoke refresh tokens and force re-authentication for any user whose email appears in harvested URL parameters or who authenticated via device-code flow from anomalous IPs. Reset credentials for any user who clicked bid-invitation lures.
• Inventory and rotate exposed secrets: AI model API keys, cloud credentials, and SSH keys on any host running an AI pentesting harness. Audit all authorized_keys files for unauthorized additions.
• Take internet-facing Cairn (or similar agentic) harnesses offline or behind authentication immediately.

1 week:

• Enforce Conditional Access policies restricting device-code grant flow; require phishing-resistant MFA (FIDO2/passkeys) so token replay value collapses.
• Deploy attachment detonation that handles password-protected files (extract password from message body before sandboxing) and tune mail filtering for bid-invitation and document-share lure themes.
• Architecturally isolate AI agents: least-privilege service identities, no standing access to secrets stores, egress allow-listing for harness hosts, and signed/allow-listed task inputs so agents cannot be instructed into self-compromise.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub