October 2026 brought another wave of cyber threats targeting US businesses, with attackers exploiting trusted platforms, legitimate authentication processes, and everyday business workflows. For enterprises, these campaigns raise the stakes beyond individual security incidents, increasing the risk of financial losses, data breaches, and costly operational disruption.
Below, we examine five active cyber threats through real-world sandbox investigations, revealing how they operate, the risks they pose to organizations, and how security teams can detect and contain attacks faster to minimize business impact.
1. SkyW4lker: Microsoft 365 Phishing Puts US Corporate Accounts at Risk
SkyW4lker is an active phishing kit that exploits Microsoft's legitimate device-code authentication to compromise corporate accounts without stealing passwords or bypassing MFA. ANY.RUN researchers identified 618 related sandbox analyses between June and October 21, 2026, with 46% coming from the US.
The attack starts with phishing emails disguised as contracts, invoices, or business proposals. Victims pass through CAPTCHA checks and trusted platforms before being directed to Microsoft's legitimate authentication page, where entering a device code can grant attackers unauthorized account access.
 |
| SkyW4lker phishkit attack overview |
Uncovering the Full Campaign in Seconds with Related Threat Context
One phishing URL can reveal an entire threat operation. ANY.RUN's powerful new capability, Related Threat Context, instantly connects suspicious activity to previous sandbox investigations and wider threat intelligence. In the SkyW4lker investigation, it helped researchers uncover additional malicious infrastructure and trace technical links to Gabagool, another phishing kit, significantly reducing manual investigation work.
Starting with a SkyW4lker sandbox session, researchers pivoted directly from Related Threat Context into TI Lookup to investigate IP address 198.23.223.185, revealing related URLs and threat activity.
 |
| Related Threat Context connects a suspicious IP to previous investigations and threat intelligence |
The results revealed related activity across technology, government, education, consulting, and healthcare organizations, with submissions from the US, Latin America, and Europe. SOC teams can use the associated URLs to enrich existing detection systems and hunt for connected threats. This reduces manual investigation work, speeds up triage, and helps organizations identify potential exposure before it leads to costly incidents.
 |
| TI Lookup reveals threat activity linked to SkyW4lker's IP address |
To protect your organization: Restrict unnecessary device-code authentication through Microsoft Entra Conditional Access and investigate suspicious indicators beyond the initial alert. Use ANY.RUN's Related Threat Context to identify connected infrastructure and collect relevant IOCs for proactive detection, helping your SOC contain threats faster and reduce the risk of costly incidents.
Cut MTTR by 21 minutes per case and reduce the impact of cyberattacks.
Give your SOC the evidence to investigate faster and contain threats sooner.
2. Fake AI Campaigns Target US Businesses with Credential Theft and Account Compromise
Cybercriminals are exploiting AI adoption through fake applications and event invitations impersonating ChatGPT, Claude, and other popular services. ANY.RUN researchers linked 1,258 sandbox analyses to fake AI campaigns, with the US ranking second worldwide.
 |
| The US is the second-largest source of submissions overall and ranks first in two major campaign groups |
Attackers use fraudulent downloads to spread malware and fake event invitations to steal Microsoft 365 and Google account access. In one particularly deceptive case, a genuine Claude installer ran while hidden processes stole browser session cookies, potentially allowing attackers to access business accounts without triggering another MFA prompt.
Investigate the Claude malware sample
 |
| ANY.RUN’s sandbox session with trojanized installer |
To protect your organization: Approve trusted AI applications, restrict unauthorized installations, and verify unexpected event invitations. Use ANY.RUN's Interactive Sandbox to expose malicious downloads and phishing redirects, helping prevent credential theft, reduce investigation costs, and limit business disruption.
3. GeorgeGinx: Device Code Phishing Targets US Government, Banking, and Healthcare
GeorgeGinx is an active Phishing-as-a-Service (PhaaS) operation targeting US government, banking, healthcare, and IT organizations. Attackers exploit legitimate Adobe Shared Links to redirect victims to Microsoft Device Code phishing pages, potentially gaining unauthorized access to corporate accounts without stealing passwords.
 |
| ANY.RUN's In-Browser Data Inspection reveals HTML DOM activity behind a trusted Adobe link. |
To investigate how GeorgeGinx conceals phishing destinations behind trusted Adobe links, researchers used ANY.RUN's In-Browser Data Inspection to examine HTML DOM changes and HTTP requests. The investigation also uncovered an administration panel on an attack server, providing further insight into the phishing operation.
To protect your organization: Don't trust document-sharing links based on their domain alone. Use ANY.RUN's In-Browser Data Inspection to examine hidden redirects, page scripts, and HTTP requests, helping your SOC uncover phishing activity behind legitimate services and prevent costly account compromise.
4. WKLP: Malware Disables Microsoft Defender to Gain Persistent Remote Access
WKLP is a Python-based infostealer and remote access trojan (RAT) observed targeting government organizations in the US and France. It steals credentials, browser data, and sensitive files while allowing attackers to maintain access to compromised systems.
The malware uses PowerShell and a legitimate Python runtime to execute malicious code. WKLP adds Microsoft Defender exclusions, terminates security processes, and creates disguised firewall rules, weakening endpoint protection and increasing the risk of data theft and prolonged compromise.
 |
| ANY.RUN detects malicious Python activity disguised as MoUsoCoreWorker.exe. |
To protect your organization: Enable Microsoft Defender Tamper Protection and monitor unauthorized security exclusions, suspicious PowerShell activity, and firewall changes. Use ANY.RUN's Interactive Sandbox to uncover hidden malware behavior and auto-generate a detailed Tier 1 report with clear evidence and response recommendations, helping teams contain threats faster and reduce costly incident recovery.
5. Mir0Auth: Microsoft 365 Token Theft Puts US Corporate Accounts at Risk
Mir0Auth is a phishing kit targeting Microsoft 365 users, with significant activity observed against US organizations. It exploits legitimate Device Code authentication to steal access tokens and compromise corporate accounts without requiring stolen passwords.
 |
| Mir0Auth phishkit details |
The attack begins with phishing emails containing malicious PDF attachments that redirect victims to fake DocuSign pages. ANY.RUN researchers uncovered obfuscated scripts and hidden authentication requests used to obtain Microsoft 365 tokens, potentially giving attackers access to sensitive business communications and data.
To protect your organization: Monitor suspicious device-code authentication and revoke compromised Microsoft 365 sessions. Keep detection systems updated with fresh malicious URLs and domains from real-world investigations through ANY.RUN's Threat Intelligence Feeds to identify related phishing activity earlier and limit the risk of account takeover.
How US Enterprises Can Cut Cyber Risk Without Increasing SOC Costs
October's attacks show how quickly a phishing link, malicious download, or compromised account can lead to financial losses, data theft, and operational disruption. For CISOs, the priority is to reduce exposure to these risks without adding more pressure on already stretched security teams.
ANY.RUN helps enterprises improve SOC performance and get more value from their existing security investments:
- 94% faster threat triage: Quickly identify malicious activity and gather the evidence needed to make informed containment decisions.
- 21 minutes less MTTR per incident: Contain attacks sooner, limiting opportunities for data theft, unauthorized access, and operational disruption.
- 30% fewer Tier 1-to-Tier 2 escalations: Resolve more incidents at the first level, freeing senior security specialists to focus on complex threats.
- 30% unique malicious IOCs: Bring threat indicators found in ANY.RUN customer sandbox investigations directly into your existing security systems, helping detect malicious infrastructure that other intelligence sources may miss.
These improvements allow security leaders to handle growing threat volumes with existing resources, control investigation costs, and reduce the potential impact of a successful attack.
Protect your business from costly breaches without increasing SOC spending.
Give your SOC the behavioral evidence and threat context to act faster.
