SkyW4lker Phishing Kit + K2F Launcher RAT + Bank Phish Cloaking Network: OTX Pulse Analysis — Enterprise Detection Pack

Threat Summary

The four pulses collectively illustrate a concerted credential-theft ecosystem leveraging diverse initial access vectors to compromise enterprise, gaming, and financial sectors. The SkyW4lker phishing kit exploits Microsoft 365 device-code OAuth flows to bypass MFA without password theft, while the K2F remote access agent represents a software supply-chain compromise via tampered CDN scripts for the Goddess of Victory: NIKKE PC launcher, enabling arbitrary command execution and theft of browser credentials, cryptocurrency wallets, and cloud service tokens. Concurrently, GTA VI-themed phishing lures capitalize on consumer hype to distribute credential stealers, and a sophisticated bank-phishing network targets 189 US financial institutions using cloaking techniques that evade takedown by serving benign content to security scanners. These campaigns share a common objective: harvesting credentials and session tokens for downstream access, fraud, or resale on dark web markets, with evidence suggesting potential connections to the "gabagool" phishing infrastructure in the SkyW4lker cluster.

Threat Actor / Malware Profile

SkyW4lker Phishing Kit
This kit targets Microsoft 365 environments through device-code phishing, where victims are lured into entering a code on Microsoft's legitimate device login page, granting attackers OAuth tokens without triggering MFA. The kit is distributed via domains such as off365mail.club and eccentric-authentication.com, and has been observed in 618 sandbox analyses between June and October 2026. Payload behavior includes session hijacking and mailbox access, with C2 communication over HTTPS to attacker-controlled domains. Persistence is achieved through OAuth token refresh mechanisms, and anti-analysis techniques include the use of legitimate Microsoft domains to blend in with normal traffic.

K2F Remote Access Agent
Delivered through a supply-chain compromise of the NIKKE PC launcher CDN, K2F is a LuaJIT-based RAT that executes arbitrary commands and steals credentials from browsers, cryptocurrency wallets, and cloud services. The malware is fetched from hijacked domains like insightjs.org and IP addresses 89.126.250.172 and 89.127.233.127. C2 communication likely occurs over HTTP/S to these hosts, with persistence potentially via scheduled tasks or registry run keys. Anti-analysis is inferred through CDN-based distribution, which may evade traditional AV signatures, and the use of legitimate gaming infrastructure to mask malicious activity.

GTA VI Phishing Lures
These campaigns use newly registered domains (e.g., gta6cyberleek.com, cyberleek.click) to distribute credential-stealing malware disguised as game downloads or early access offers. The payload behavior involves harvesting credentials from infected systems, with C2 likely to the same domains or associated IPs. Persistence mechanisms are not detailed but may include standard stealer techniques like browser extension injection or startup folder entries.

Bank-Phishing Network with Fake Takedown
This network operates 248 live look-alike domains targeting 189 US financial institutions, using a cloaking technique that displays fake "account suspended" pages to returning visitors while serving phishing content to first-time visitors. The domains follow a naming pattern combining urgency keywords with bank names (e.g., 53primaryset.com, authorize-valley.com). Payload behavior is credential theft via phishing forms, with C2 communication to the phishing domains. Anti-analysis is achieved through the cloaking mechanism, which serves benign content to security researchers and automated takedown systems.

IOC Analysis

The indicators across these pulses include a mix of domains, IPv4 addresses, file hashes, and CVEs, each requiring specific operationalization by SOC teams. Domains (e.g., 5200m.com, insightjs.org, gta6cyberleek.com, 53primaryset.com) should be blocked at the DNS and proxy levels, with wildcard rules applied to related TLDs. IPv4 addresses (89.126.250.172, 89.127.233.127) associated with K2F C2 should be added to firewall blocklists and monitored for outbound connections. File hashes (SHA256: 2f2aac505f486067af6831d6c75ea74df63acb1ed4e4002709c5962c68bd9203, MD5: 481e9b5ab8fb93406bf31980b53e0578) can be used for endpoint detection and historical hunting in EDR platforms. The CVE (CVE-2026-98432) related to the NIKKE launcher compromise should be cross-referenced with asset inventories to identify vulnerable systems. SOC teams should leverage threat intelligence platforms like MISP or ThreatConnect to ingest and correlate these indicators, and use sandbox analysis tools (e.g., ANY.RUN) to decode malware behavior and extract additional IOCs from phishing kits and RATs.

Detection Engineering

---
title: SkyW4lker Device-Code Phishing OAuth Token Theft
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
description: Detects suspicious device-code authentication flows to Microsoft 365 from known SkyW4lker phishing domains, indicating potential OAuth token theft.
status: experimental
date: 2026/11/05
author: Security Arsenal
logsource:
  category: webserver
  product: microsoft
  service: azureactivedirectory
detection:
  selection:
    - DeviceCodeFlow: true
    - ClientAppUsed: 'Browser'
    - IPAddress|contains:
        - '5200m.com'
        - 'off365mail.club'
        - 'eccentric-authentication.com'
        - 'fosterswifts.com'
        - 'kuer.online'
        - 'mouphyweb.com'
        - 'photosofus.com'
        - 'nicewayrealestate.cc'
  condition: selection
falsepositives:
  - Legitimate device-code flows from corporate devices
level: high
tags:
  - attack.initial_access
  - attack.t1566
  - attack.t1528
---
title: K2F RAT CDN Compromise and Credential Theft
id: b2c3d4e5-6789-01bc-def2-3456789012bc
description: Identifies network connections to known K2F C2 infrastructure and execution of LuaJIT-based payloads from tampered CDN scripts.
status: experimental
date: 2026/11/05
author: Security Arsenal
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    - DestinationIp:
        - '89.126.250.172'
        - '89.127.233.127'
    - DestinationHostname|endswith:
        - 'insightjs.org'
        - 'analytics.insightjs.com'
  selection_process:
    - Image|endswith: '\luajit.exe'
    - CommandLine|contains: 'insightjs.org'
  condition: selection or selection_process
falsepositives:
  - Legitimate gaming traffic to CDN domains
level: critical
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1059
  - attack.t1555
---
title: Bank Phishing Cloaking Domain Access
id: c3d4e5f6-7890-12cd-ef34-5678901234cd
description: Flags access to look-alike domains used in bank-phishing campaigns with fake takedown cloaking, targeting US financial institutions.
status: experimental
date: 2026/11/05
author: Security Arsenal
logsource:
  category: proxy
detection:
  selection:
    - c-uri|contains:
        - '53primaryset.com'
        - 'authorize-valley.com'
        - 'commercial-atfirst.com'
        - 'protect-pinnaclefp.com'
  condition: selection
falsepositives:
  - Typosquatting by legitimate users
level: medium
tags:
  - attack.initial_access
  - attack.t1566
  - attack.t1036

// Hunt for SkyW4lker device-code phishing and K2F RAT C2 communication
let skyw4lker_domains = dynamic(["5200m.com", "off365mail.club", "eccentric-authentication.com", "fosterswifts.com", "kuer.online", "mouphyweb.com", "photosofus.com", "nicewayrealestate.cc"]);
let k2f_ips = dynamic(["89.126.250.172", "89.127.233.127"]);
let k2f_domains = dynamic(["insightjs.org", "analytics.insightjs.com"]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where RemoteUrl in~ (skyw4lker_domains) or RemoteIP in (k2f_ips) or RemoteUrl in~ (k2f_domains)
    | project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, ActionType),
    (DeviceProcessEvents
    | where ProcessCommandLine contains "luajit" and ProcessCommandLine contains "insightjs.org"
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName),
    (SigninLogs
    | where DeviceDetail has "device_code" and IPAddress has_any (skyw4lker_domains)
    | project TimeGenerated, UserPrincipalName, IPAddress, DeviceDetail, Status)
| order by Timestamp desc

# IOC Hunt Script for SkyW4lker, K2F, and Bank Phishing Indicators
$skyw4lker_domains = @("5200m.com", "off365mail.club", "eccentric-authentication.com", "fosterswifts.com", "kuer.online", "mouphyweb.com", "photosofus.com", "nicewayrealestate.cc")
$k2f_ips = @("89.126.250.172", "89.127.233.127")
$k2f_domains = @("insightjs.org", "analytics.insightjs.com")
$bank_phish_domains = @("53primaryset.com", "authorize-valley.com", "commercial-atfirst.com", "protect-pinnaclefp.com")
$k2f_hashes = @("2f2aac505f486067af6831d6c75ea74df63acb1ed4e4002709c5962c68bd9203", "3aaafbd612f04501a6fdb0bb8b2f8a87796223e5584ac18ea5eb180feeafb193", "481e9b5ab8fb93406bf31980b53e0578")

# Check network connections to malicious IPs/domains
Write-Host "[+] Checking network connections to known malicious IPs and domains..."
$netstat = Get-NetTCPConnection | Where-Object { $_.RemoteAddress -in $k2f_ips }
if ($netstat) { $netstat | Format-Table -AutoSize } else { Write-Host "No connections to K2F IPs found." }

# Check DNS cache for malicious domains
Write-Host "[+] Checking DNS cache for malicious domains..."
$dns_cache = Get-DnsClientCache | Where-Object { $_.Name -in ($skyw4lker_domains + $k2f_domains + $bank_phish_domains) }
if ($dns_cache) { $dns_cache | Format-Table -AutoSize } else { Write-Host "No malicious domains in DNS cache." }

# Check for K2F file hashes in common temp/download directories
Write-Host "[+] Checking for K2F file hashes in temp and download directories..."
$paths = @("$env:TEMP", "$env:USERPROFILE\Downloads", "$env:APPDATA")
foreach ($path in $paths) {
    Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
        $hash = Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue
        if ($hash.Hash -in $k2f_hashes) { Write-Host "Malicious file found: $($_.FullName)" }
    }
}

# Check for suspicious OAuth device-code events in Windows Event Logs (if Azure AD Connect is present)
Write-Host "[+] Checking for device-code authentication events in Security logs..."
$events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4648} -ErrorAction SilentlyContinue | Where-Object { $_.Message -match "device_code" }
if ($events) { $events | Select-Object TimeCreated, Message | Format-Table -AutoSize } else { Write-Host "No device-code events found." }

Write-Host "[+] IOC hunt completed."

Response Priorities

Immediate (0-4 hours):

• Block all listed domains and IPs at DNS, proxy, and firewall levels.
• Deploy Sigma rules to SIEM for real-time detection of SkyW4lker OAuth flows and K2F C2 connections.
• Hunt for K2F file hashes in endpoint telemetry and quarantine infected systems.
• Alert on any device-code authentication events from non-corporate IP ranges.

24 Hours:

• If credential-stealing malware is detected (e.g., K2F or phishing kits), initiate identity verification for affected users: force password resets, revoke active sessions, and re-enroll MFA.
• Review Azure AD sign-in logs for anomalous OAuth grants and revoke suspicious tokens.
• Conduct a targeted phishing awareness campaign for users in targeted sectors (finance, gaming, tech).

1 Week:

• Harden architecture based on attack vectors: implement conditional access policies to restrict device-code flows to compliant devices, enable advanced phishing protection in email gateways, and segment gaming/developer networks from corporate resources.
• Audit CDN and third-party software dependencies for integrity monitoring.
• Update incident response playbooks to include supply-chain and OAuth token theft scenarios.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub