Five Active Threats Challenge US Enterprise Defences

Five active campaigns highlighted by ANY.RUN show how US enterprises were targeted during October 2026 through Microsoft 365 device-code phishing, fraudulent AI-themed downloads, trusted document-sharing links and malware that weakens endpoint protections. The campaigns are SkyW4lker, fake AI lures, GeorgeGinx, WKLP and Mir0Auth.

The figures point to broad exposure rather than a single technique. ANY.RUN identified 618 sandbox analyses related to SkyW4lker between June and October 21, 2026, with 46% originating in the US. It also linked 1,258 analyses to fake AI campaigns, with the US ranked second worldwide.

Trusted services are being used as an entry point

SkyW4lker uses phishing messages presented as contracts, invoices or business proposals. After CAPTCHA checks and other trusted platforms, victims are directed to Microsoft’s legitimate device-code authentication page. Entering the code can grant an attacker account access without the attacker having to steal a password or bypass MFA.

GeorgeGinx follows a related pattern. The phishing-as-a-service operation has targeted US government, banking, healthcare and IT organisations, using legitimate Adobe Shared Links to redirect recipients to Microsoft Device Code phishing pages. ANY.RUN’s examination of HTML DOM changes and HTTP requests found concealed phishing destinations behind the trusted sharing service.

Mir0Auth also targets Microsoft 365 users through device-code authentication. Its chain begins with phishing emails carrying malicious PDF attachments that lead to fake DocuSign pages. Researchers found obfuscated scripts and hidden authentication requests designed to obtain Microsoft 365 tokens, potentially exposing corporate communications and data.

AI branding and endpoint evasion extend the risk

Fake AI campaigns impersonate products including ChatGPT and Claude, using bogus applications and event invitations to obtain Microsoft 365 and Google account access. In one case, a genuine Claude installer ran while concealed processes stole browser session cookies, which could allow access to business accounts without a further MFA prompt.

WKLP adds a different form of exposure. The Python-based infostealer and remote-access trojan was observed against government organisations in the US and France. It uses PowerShell and a legitimate Python runtime, steals credentials, browser data and sensitive files, adds Microsoft Defender exclusions, terminates security processes and creates disguised firewall rules to preserve access.

Controls should focus on identity and observable behaviour

For identity teams, the immediate measures are to restrict unnecessary device-code authentication through Microsoft Entra Conditional Access, monitor suspicious device-code events and revoke compromised Microsoft 365 sessions. Document-sharing links should be assessed for redirects and page behaviour rather than trusted solely because of their domain.

Endpoint teams should enable Microsoft Defender Tamper Protection and watch for unauthorised exclusions, suspicious PowerShell execution and unexpected firewall changes. Businesses can reduce the likelihood that these campaigns become disruptive incidents by approving trusted AI applications, restricting unauthorised installations, validating unsolicited invitations and using current indicators to investigate connected infrastructure promptly.