October 2026 brought another wave of cyber threats targeting US enterprises, exposing security gaps that could lead to financial losses, data breaches, and business disruption. Attackers exploited trusted platforms, legitimate authentication processes, and growing AI adoption to gain access to corporate accounts and systems, making early detection and containment increasingly difficult.
For SOC teams, these attacks raise important questions about the effectiveness of existing defenses, incident response costs, and the ability of SOC teams to handle evolving threats.
What October’s Attacks Reveal About US Enterprise Risk
October’s threat activity exposed several security challenges that US organizations need to address to reduce the risk of costly incidents:
- MFA alone cannot prevent account compromise: SkyW4lker, GeorgeGinx, and Mir0Auth abused legitimate Microsoft device-code authentication to gain unauthorized access without stealing passwords.
- Trusted platforms are becoming attack entry points: Fake AI campaigns and GeorgeGinx exploited familiar brands, document-sharing services, and business invitations to make phishing attempts harder to recognize.
- AI adoption introduces new security risks: Malicious AI installers and fraudulent event invitations exposed employees to credential theft, malware infections, and unauthorized account access.
- Endpoint protection can be deliberately weakened: WKLP modified Microsoft Defender exclusions and firewall rules to maintain remote access, increasing the risk of prolonged compromise and data theft.
- A single alert may hide a much larger campaign: SkyW4lker investigations revealed connected malicious infrastructure and related phishing activity, showing why organizations need visibility beyond individual indicators.
- Delayed investigations increase business exposure: When malicious activity spans multiple services and systems, security teams need to connect the evidence quickly to limit unauthorized access, financial losses, and recovery costs.
Close security gaps before they lead to costly incidents. Give your SOC the threat visibility to detect and respond earlier >>Reduce Business Risk
Who Attackers Targeted in October
October’s attacks primarily targeted US organizations, Microsoft 365 users, and employees relying on AI applications and trusted business platforms.
1. SkyW4lker Targets US Enterprises with Microsoft 365 Device-Code Phishing
SkyW4lker is an active phishing kit that abuses legitimate Microsoft device-code authentication to gain unauthorized access to corporate accounts without stealing passwords or bypassing MFA.ANY.RUNresearchers identified 618 related sandbox analyses between June and October 21, 2026, with 46% coming from the US. Monthly submissions grew from 20 in June to 200 in September.
Check SkyW4lker sandbox session
The attack begins with password-protected documents disguised as contracts, invoices, or business proposals. Victims pass through CAPTCHA checks and trusted platforms before reaching a page that instructs them to enter a device code on Microsoft’s legitimate authentication website.
From One Phishing URL to a Full Campaign Context in Seconds
ANY.RUN’s powerful newRelated Threat Contexthelped researchers connect SkyW4lker activity to previous sandbox investigations and uncover additional malicious infrastructure. Further analysis also revealed technical links to Gabagool, another phishing kit believed to share the same developer.
Starting with a SkyW4lker sandbox session, researchers used Related Threat Context to pivot directly intoANY.RUN’sThreat Intelligence Lookupfor IP address 198.23.223.185, expanding the investigation beyond the initial phishing URL.
The Threat Intelligence results linked the IP to 203 URLs across 10 domains and 30 sandbox analyses, with related activity involving technology, government, education, finance, and consulting. Submissions came from 10 countries, including the US, Colombia, and Germany.
Give your SOC the context they need for faster triage. Cut repetitive investigations. Increase Tier 1 productivity >>Boost Your SOC
Identity risk to reduce: SkyW4lker can compromise Microsoft 365 accounts through legitimate authentication flows, putting sensitive business data at risk. Restrict unnecessary device-code authentication and useANY.RUN’s Related Threat Context to trace connected phishing infrastructure, identify additional indicators, and strengthen detection before attackers expand their access.
2. Fake AI Campaigns Spread Malware and Steal Sessions, Raising Corporate Data Theft Risks
Cybercriminals are exploiting growing AI adoption through fake applications, malicious download pages, and fraudulent event invitations impersonating ChatGPT, Claude, and other popular services.ANY.RUNresearchers identified 1,258 public sandbox analyses between April 15 and October 5, 2026, with the US ranking second worldwide in submission activity.
The campaigns use different approaches to target employees. Fake AI downloads and installation guides trick users into executing malicious commands, while fraudulent event invitations redirect victims to Microsoft 365 and Google phishing pages. 45% of the analyzed activity involved paste-command attacks, exposing organizations to malware infections, credential theft, and unauthorized account access.
Investigate the Claude malware sample
Data theft risk to reduce: Fake AI campaigns can expose corporate credentials, active sessions, and sensitive business information. Organizations should establish approved AI software sources, restrict unauthorized script execution, and useInteractive Sandboxto identify malicious behavior before it leads to wider compromise.
3. GeorgeGinx Hides Device-Code Phishing Behind Trusted Adobe Links, Threatening Corporate Accounts
GeorgeGinx is an active Phishing-as-a-Service (PhaaS) operation targeting government, banking, healthcare, and IT organizations in the US. Attackers exploit legitimate Adobe Shared Links to redirect victims to Microsoft device-code phishing pages, potentially gaining unauthorized access to corporate accounts without stealing passwords.
The campaign takes advantage of trusted document-sharing workflows to conceal its phishing destinations. UsingANY.RUN’sIn-Browser Data Inspection, researchers examined HTML DOM activity and HTTP requests behind an Adobe link to investigate the redirect chain.
Further investigation uncovered an administration panel on an attack server, providing additional insight into the infrastructure supporting the GeorgeGinx operation.
4. WKLP Weakens Microsoft Defender, Exposing Organizations to Data Theft and Persistent Access
WKLP is a Python-based infostealer and remote access trojan (RAT) observed targeting government organizations in the US and France. It collects credentials, browser data, password-<a href="https://bitcomme.com/data-manager-in-google-analytics-2/” title=”Data Manager In Google Analytics”>manager information, and sensitive files while giving attackers remote control over compromised endpoints.
The attack uses PowerShell to launch a legitimate Python runtime disguised as the Windows process MoUsoCoreWorker.exe. WKLP adds Microsoft Defender exclusions, terminates security processes, and creates firewall rules disguised as Windows Update Service, weakening protections that would normally help detect and contain the infection.
Beyond stealing data, WKLP gives attackers the ability to execute remote commands, deploy additional payloads, and access a victim’s screen, camera, microphone, and clipboard. It also uses a watchdog mechanism to restore deleted malware copies, making complete removal more difficult.
Cut Investigation Workload Without Expanding Your SOC. Resolve more threats at Tier 1 with clear evidence and response guidance >>Boost Your SOC
5. Mir0Auth Uses Fake DocuSign Pages to Hijack Microsoft 365 Sessions, Putting Business Data at Risk
Mir0Auth is a phishing kit targeting Microsoft 365 authentication tokens, with activity primarily observed against US organizations. The attack begins with phishing emails containing PDF attachments that direct victims to fake DocuSign pages, eventually leading them into Microsoft’s legitimate device-code authentication process.
The kit uses obfuscated network communication and disguised endpoints, including /task_queue.cs, /context.go, and /window.rs, to request device codes and track authentication sessions. Once victims complete the sign-in process, attackers can obtain access tokens without stealing passwords, potentially gaining access to sensitive corporate emails and documents.
Identity risk to reduce: Stolen authentication tokens can leave corporate accounts exposed even after a password change. Organizations should review token activity and strengthen controls over device-code authentication. Behavioral analysis withANY.RUNhelps teams recognize suspicious authentication patterns and understand how phishing attempts unfold, supporting more accurate incident response and reducing the risk of data exposure.
Detect up to 58% more threats with behavioral evidence and deeper insights from Interactive Sandbox analysis >>Boost Your Threat Visibility
