October 2026 brought another wave of cyber threats targeting US enterprises, exposing security gaps that could lead to financial losses, data breaches, and business disruption. Attackers exploited trusted platforms, legitimate authentication processes, and growing AI adoption to gain access to corporate accounts and systems, making early detection and containment increasingly difficult.
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
For SOC teams, these attacks raise important questions about the effectiveness of existing defenses, incident response costs, and the ability of SOC teams to handle evolving threats.
What October’s Attacks Reveal About US Enterprise Risk
October’s threat activity exposed several security challenges that US organizations need to address to reduce the risk of costly incidents:
- MFA alone cannot prevent account compromise: SkyW4lker, GeorgeGinx, and Mir0Auth abused legitimate Microsoft device-code authentication to gain unauthorized access without stealing passwords.
- Trusted platforms are becoming attack entry points: Fake AI campaigns and GeorgeGinx exploited familiar brands, document-sharing services, and business invitations to make phishing attempts harder to recognize.
- AI adoption introduces new security risks: Malicious AI installers and fraudulent event invitations exposed employees to credential theft, malware infections, and unauthorized account access.
- Endpoint protection can be deliberately weakened: WKLP modified Microsoft Defender exclusions and firewall rules to maintain remote access, increasing the risk of prolonged compromise and data theft.
- A single alert may hide a much larger campaign: SkyW4lker investigations revealed connected malicious infrastructure and related phishing activity, showing why organizations need visibility beyond individual indicators.
- Delayed investigations increase business exposure: When malicious activity spans multiple services and systems, security teams need to connect the evidence quickly to limit unauthorized access, financial losses, and recovery costs.
Close security gaps before they lead to costly incidents.
Give your SOC the threat visibility to detect and respond earlier.
Who Attackers Targeted in October
October’s attacks primarily targeted US organizations, Microsoft 365 users, and employees relying on AI applications and trusted business platforms.
<thead> <tr>
<th>
Target Group </th>
<th>
What We Observed </th>
</tr>
</thead><tbody> <tr>
<td>
US enterprises </td>
<td>
46% of SkyW4lker submissions came from the US, which also ranked second in fake AI activity. </td>
</tr>
<tr>
<td>
Technology, manufacturing, and government </td>
<td>
These sectors appeared prominently in SkyW4lker investigations. </td>
</tr>
<tr>
<td>
Microsoft 365 users </td>
<td>
SkyW4lker, GeorgeGinx, and Mir0Auth abused device-code authentication to compromise accounts. </td>
</tr>
<tr>
<td>
Employees using AI applications </td>
<td>
Fake downloads and event invitations exposed users to malware and credential theft. </td>
</tr>
<tr>
<td>
Government organizations </td>
<td>
WKLP targeted organizations in the US and France, stealing data and enabling remote access. </td>
</tr>
<tr>
<td>
Users of document-sharing platforms </td>
<td>
GeorgeGinx and Mir0Auth exploited Adobe and DocuSign-themed lures to deliver phishing attacks. </td>
</tr>
</tbody></table>
1. SkyW4lker Targets US Enterprises with Microsoft 365 Device-Code Phishing
SkyW4lker is an active phishing kit that abuses legitimate Microsoft device-code authentication to gain unauthorized access to corporate accounts without stealing passwords or bypassing MFA. ANY.RUN researchers identified 618 related sandbox analyses between June and October 21, 2026, with 46% coming from the US. Monthly submissions grew from 20 in June to 200 in September.
Check SkyW4lker sandbox session
SkyW4lker phishkit attack overview
The attack begins with password-protected documents disguised as contracts, invoices, or business proposals. Victims pass through CAPTCHA checks and trusted platforms before reaching a page that instructs them to enter a device code on Microsoft’s legitimate authentication website.
From One Phishing URL to a Full Campaign Context in Seconds
ANY.RUN’s powerful new Related Threat Context helped researchers connect SkyW4lker activity to previous sandbox investigations and uncover additional malicious infrastructure. Further analysis also revealed technical links to Gabagool, another phishing kit believed to share the same developer.
Starting with a SkyW4lker sandbox session, researchers used Related Threat Context to pivot directly into ANY.RUN’s Threat Intelligence Lookup for IP address 198.23.223.185, expanding the investigation beyond the initial phishing URL.
Related Threat Context connects a suspicious IP to previous investigations and threat intelligence
The Threat Intelligence results linked the IP to 203 URLs across 10 domains and 30 sandbox analyses, with related activity involving technology, government, education, finance, and consulting. Submissions came from 10 countries, including the US, Colombia, and Germany.
TI Lookup reveals connected threat intelligence for SkyW4lker’s IP address By connecting individual sandbox findings with wider threat intelligence, SOC teams can identify related infrastructure, collect relevant indicators for proactive detection, and investigate potential exposure without spending hours manually piecing together the evidence.
Give your SOC the context they need for faster triage.
Cut repetitive investigations. Increase Tier 1 productivity.
Identity risk to reduce: SkyW4lker can compromise Microsoft 365 accounts through legitimate authentication flows, putting sensitive business data at risk. Restrict unnecessary device-code authentication and use ANY.RUN’s Related Threat Context to trace connected phishing infrastructure, identify additional indicators, and strengthen detection before attackers expand their access.
2. Fake AI Campaigns Spread Malware and Steal Sessions, Raising Corporate Data Theft Risks
Cybercriminals are exploiting growing AI adoption through fake applications, malicious download pages, and fraudulent event invitations impersonating ChatGPT, Claude, and other popular services. ANY.RUN researchers identified 1,258 public sandbox analyses between April 15 and October 5, 2026, with the US ranking second worldwide in submission activity.
The US is the second-largest source of submissions overall and ranks first in two major campaign groups
The campaigns use different approaches to target employees. Fake AI downloads and installation guides trick users into executing malicious commands, while fraudulent event invitations redirect victims to Microsoft 365 and Google phishing pages. 45% of the analyzed activity involved paste-command attacks, exposing organizations to malware infections, credential theft, and unauthorized account access.
Investigate the Claude malware sample
ANY.RUN’s sandbox session with trojanized installer
Data theft risk to reduce: Fake AI campaigns can expose corporate credentials, active sessions, and sensitive business information. Organizations should establish approved AI software sources, restrict unauthorized script execution, and use Interactive Sandbox to identify malicious behavior before it leads to wider compromise.
3. GeorgeGinx Hides Device-Code Phishing Behind Trusted Adobe Links, Threatening Corporate Accounts
GeorgeGinx is an active Phishing-as-a-Service (PhaaS) operation targeting government, banking, healthcare, and IT organizations in the US. Attackers exploit legitimate Adobe Shared Links to redirect victims to Microsoft device-code phishing pages, potentially gaining unauthorized access to corporate accounts without stealing passwords.
In-Browser Data Inspection reveals activity behind a trusted Adobe Shared Link The campaign takes advantage of trusted document-sharing workflows to conceal its phishing destinations. Using ANY.RUN’s In-Browser Data Inspection, researchers examined HTML DOM activity and HTTP requests behind an Adobe link to investigate the redirect chain.
Further investigation uncovered an administration panel on an attack server, providing additional insight into the infrastructure supporting the GeorgeGinx operation.
Account takeover risk to reduce: Trusted document-sharing domains should not automatically be treated as safe. Security teams should inspect where external links ultimately lead and analyze suspicious browser activity with ANY.RUN’s In-Browser Data Inspection. This helps expose hidden phishing destinations and reduce the risk of unauthorized access to corporate accounts.
4. WKLP Weakens Microsoft Defender, Exposing Organizations to Data Theft and Persistent Access
WKLP is a Python-based infostealer and remote access trojan (RAT) observed targeting government organizations in the US and France. It collects credentials, browser data, password-manager information, and sensitive files while giving attackers remote control over compromised endpoints.
The attack uses PowerShell to launch a legitimate Python runtime disguised as the Windows process MoUsoCoreWorker.exe. WKLP adds Microsoft Defender exclusions, terminates security processes, and creates firewall rules disguised as Windows Update Service, weakening protections that would normally help detect and contain the infection.
ANY.RUN detects malicious Python activity disguised as MoUsoCoreWorker.exe
Beyond stealing data, WKLP gives attackers the ability to execute remote commands, deploy additional payloads, and access a victim’s screen, camera, microphone, and clipboard. It also uses a watchdog mechanism to restore deleted malware copies, making complete removal more difficult.
Endpoint risk to reduce: Removing WKLP’s malicious files may not be enough to stop the attack. Security teams should check for persistence mechanisms, restore modified Defender settings, and review suspicious connections. ANY.RUN’s Tier 1 reports bring together behavioral evidence and response recommendations, helping analysts identify the full scope of the infection and reduce the risk of repeated compromise.
Cut Investigation Workload Without Expanding Your SOC.
Resolve more threats at Tier 1 with clear evidence and response guidance.
5. Mir0Auth Uses Fake DocuSign Pages to Hijack Microsoft 365 Sessions, Putting Business Data at Risk
Mir0Auth is a phishing kit targeting Microsoft 365 authentication tokens, with activity primarily observed against US organizations. The attack begins with phishing emails containing PDF attachments that direct victims to fake DocuSign pages, eventually leading them into Microsoft’s legitimate device-code authentication process.
Mir0Auth phishing activity analyzed inside ANY.RUN’s Interactive Sandbox
The kit uses obfuscated network communication and disguised endpoints, including /task_queue.cs, /context.go, and /window.rs, to request device codes and track authentication sessions. Once victims complete the sign-in process, attackers can obtain access tokens without stealing passwords, potentially gaining access to sensitive corporate emails and documents.
Identity risk to reduce: Stolen authentication tokens can leave corporate accounts exposed even after a password change. Organizations should review token activity and strengthen controls over device-code authentication. Behavioral analysis with ANY.RUN helps teams recognize suspicious authentication patterns and understand how phishing attempts unfold, supporting more accurate incident response and reducing the risk of data exposure.
Close the Security Gaps Exposed by October’s Attacks
October’s campaigns showed how easily attackers can hide malicious activity behind trusted applications, legitimate authentication processes, and everyday business workflows. SkyW4lker, GeorgeGinx, and Mir0Auth exploited Microsoft authentication, fake AI campaigns concealed malware and credential theft, while WKLP weakened endpoint defenses to maintain remote access.
For security leaders, the challenge is to detect these threats early, understand their full scope, and contain them before they lead to costly incidents, without increasing SOC workload or spending.
1. Expose Malicious Behavior Before It Causes Damage
Many of October’s attacks appeared legitimate at first. Fake AI installers could run genuine applications while stealing browser sessions, and trusted document-sharing links redirected employees to phishing pages.
Complex attack analyzed inside ANY.RUN’s Interactive Sandbox
ANY.RUN’s Interactive Sandbox lets security teams examine what suspicious files and URLs actually do, exposing hidden redirects, scripts, credential theft, and malware execution. Automated Tier 1 reports turn these findings into clear summaries and response recommendations, helping analysts move from investigation to containment with less manual effort.
2. Capture the Full Threat Picture in Seconds
Finding one malicious URL or IP address rarely tells the whole story. As the SkyW4lker investigation demonstrated, a single indicator can lead to previously discovered infrastructure and related attack activity.
Related analyses help SOC teams discover additional context about IOCs to better inform response
ANY.RUN’s Related Threat Context connects sandbox findings with previous investigations and Threat Intelligence Lookup in a single workflow. Analysts can move directly from suspicious behavior to wider threat intelligence, drawing on real-world investigations from 16,000+ organizations to uncover related infrastructure and assess potential exposure faster.
3. Strengthen Detection with Fresh Threat Intelligence
October’s phishing campaigns also demonstrated why detecting one malicious link isn’t enough. Attackers can use multiple URLs and domains to reach victims, making it important to identify related infrastructure before more employees are exposed.
ANY.RUN’s TI Feeds provides with actionable IOCs
ANY.RUN’s Threat Intelligence Feeds continuously deliver fresh malicious URLs, domains, IPs, and other indicators into existing security systems. 30% of malicious IOCs from ANY.RUN customer sandbox investigations are unique, giving SOC teams additional threat data to strengthen detection and reduce reliance on manual IOC collection.
The Business Impact: Faster Response, Lower SOC Costs
Together, these capabilities help organizations improve security operations without continuously increasing resources. Enterprises using ANY.RUN report:
- 94% faster threat triage, helping teams identify malicious activity and make decisions sooner.
- 21 minutes less MTTR per incident, reducing investigation and response time.
- 30% fewer Tier 1-to-Tier 2 escalations, allowing senior specialists to focus on more complex incidents.
For CISOs, the goal is to contain more threats with the security resources already in place, reduce investigation costs, and limit the financial impact of incidents before they disrupt business operations.
Detect up to 58% more threats
with behavioral evidence and deeper insights from Interactive Sandbox analysis.
About ANY.RUN
ANY.RUN provides interactive malware analysis and threat intelligence solutions used by more than 700,000 cybersecurity professionals across 16,000+ organizations worldwide.
Its Interactive Sandbox gives analysts full visibility into suspicious files, URLs, phishing pages, browser activity, network traffic, processes, and other attack behavior. Threat Intelligence Lookup helps teams investigate related infrastructure and activity, while Threat Intelligence Feeds bring fresh IOCs into existing security systems.
These capabilities help reduce repetitive investigation work, give analysts more context, and support growing investigation volumes without adding the same amount of manual effort.
Keep Your Business Running, Even as Cyber Threats Evolve.
Give your SOC the evidence to contain incidents before operations suffer.
Strengthen Business Resilience
The post Major Cyber Attacks in October 2026: Fake AI, Account Takeovers, and Remote Access Threaten US and EU appeared first on ANY.RUN's Cybersecurity Blog.
Article Link: Major Cyber Attacks in October 2026: Fake AI Targets US and EU