US businesses spent October 2026 contending with five active threat campaigns that lean on trusted platforms and legitimate login flows rather than broken encryption. The research comes from ANY.RUN, whose sandbox telemetry underpins each of the findings below.
SkyW4lker, a phishing kit, abuses Microsoft's device-code authentication to reach corporate accounts without lifting a password or defeating MFA. ANY.RUN logged 618 sandbox analyses tied to it between June and October 21, 2026, with 46% originating in the US. Emails posing as contracts, invoices or proposals funnel victims past CAPTCHA checks to Microsoft's genuine authentication page, where a device code hands over account access. Pivoting from one SkyW4lker session, ANY.RUN's Related Threat Context feature surfaced extra infrastructure and technical links to a second kit, Gabagool; following IP 198.23.223.185 turned up related URLs and activity across technology, government, education, consulting and healthcare organizations in the US, Latin America and Europe.
Fake AI campaigns came next. ANY.RUN attributes 1,258 sandbox analyses to fraudulent downloads and event invitations impersonating ChatGPT, Claude and similar services, with the US second worldwide in submissions. One case stands out: a genuine Claude installer ran while hidden processes lifted browser session cookies, a route to business accounts that skips a fresh MFA prompt.
GeorgeGinx, a Phishing-as-a-Service operation, targets US government, banking, healthcare and IT organizations by hiding Microsoft device-code phishing pages behind legitimate Adobe Shared Links. Using in-browser data inspection, ANY.RUN examined HTML DOM changes and HTTP requests behind a trusted Adobe link and found an administration panel on an attack server.
WKLP is a Python-based infostealer and remote access trojan seen against government organizations in the US and France. It runs malicious code through PowerShell and a legitimate Python runtime, adds Microsoft Defender exclusions, kills security processes and creates disguised firewall rules, weakening endpoints while it steals credentials, browser data and files.
Mir0Auth rounds out the group, a phishing kit aimed at Microsoft 365 users with notable activity against US organizations. Malicious PDF attachments in emails redirect victims to fake DocuSign pages, where obfuscated scripts and hidden authentication requests harvest Microsoft 365 tokens, opening the door to business communications and data.
Device-code abuse recurs across these campaigns, so containment guidance overlaps. Restrict unnecessary device-code authentication through Microsoft Entra Conditional Access, enable Defender Tamper Protection, and monitor for unauthorized security exclusions, suspicious PowerShell and firewall changes. Treat document-sharing links as untrusted regardless of domain, approve AI applications deliberately, and revoke compromised Microsoft 365 sessions. ANY.RUN says its telemetry cuts mean time to respond by 21 minutes per case, triages threats 94% faster and reduces Tier 1-to-Tier 2 escalations by 30%.
Source: The Hackers News