cyber.hendryadrian.com
Security News · thehackernews.com

Five Active Cyber Threats Targeting US Enterprises in October 2026

· Original article ↗

Summary

ANY.RUN's October 2026 roundup describes five threats targeting US enterprises, including device-code phishing, fake AI lures, token theft and WKLP malware that disables Defender. It reports sandbox activity and offers mitigation advice; findings are vendor-attributed.

Key points

  • ANY.RUN reports 618 SkyW4lker-related sandbox analyses from June to October 21, 2026; the article says 46% came from the US. The phishing kit abuses Microsoft device-code authentication and is linked by researchers to activity involving Gabagool.
  • The article reports 1,258 sandbox analyses linked to fake AI campaigns. These use fraudulent downloads and event invitations; one described case involved a genuine Claude installer running while hidden processes stole browser session cookies.
  • GeorgeGinx reportedly uses Adobe Shared Links to redirect targets to Microsoft device-code phishing pages. Researchers examined HTML DOM changes and HTTP requests and found an administration panel on an attack server.
  • WKLP is described as a Python-based infostealer and remote access trojan targeting government organizations in the US and France. It uses PowerShell and a Python runtime, adds Microsoft Defender exclusions, terminates security processes, and creates disguised firewall rules.
  • Mir0Auth reportedly uses phishing emails with malicious PDF attachments that redirect to fake DocuSign pages; researchers found obfuscated scripts and hidden authentication requests used to obtain Microsoft 365 access tokens.
  • Suggested defenses include restricting unnecessary device-code authentication, monitoring unauthorized Defender exclusions and suspicious PowerShell or firewall changes, and revoking compromised Microsoft 365 sessions.

Article Details

Event Type
Multiple active cyber threats targeting US enterprises, including phishing kits abusing device-code authentication, fake AI campaigns, and WKLP malware.
Impact
The reported campaigns may enable unauthorized access to Microsoft 365 and other business accounts, theft of credentials, tokens, browser data, and sensitive files, and prolonged access to compromised systems. The article identifies potential financial losses, data breaches, and operational disruption; WKLP was observed targeting government organizations in the US and France.

MITRE ATT&CK

T1059.001 · PowerShellWKLP uses PowerShell to execute malicious code.T1528 · Steal Application Access TokenMir0Auth is reported to obtain Microsoft 365 access tokens through device-code authentication phishing.T1539 · Steal Web Session CookieIn a fake AI campaign, hidden processes reportedly stole browser session cookies.T1562.001 · Disable or Modify ToolsWKLP adds Microsoft Defender exclusions and terminates security processes, weakening endpoint protection.T1566.001 · Spearphishing AttachmentMir0Auth phishing emails include malicious PDF attachments that redirect victims to fake DocuSign pages.

Malware

WKLP4. WKLP: Malware Disables Microsoft Defender to Gain Persistent Remote Access

Vendors

ANY.RUNdevice-code authentication to compromise corporate accounts without stealing passwords or bypassing MFA. ANY.RUN researchers identified 618 related sandbox analyses between June and October 21, 2026, with 46% comingMicrosoft1. SkyW4lker: Microsoft 365 Phishing Puts US Corporate Accounts at Risk

Products

Adobe Shared Linkstargeting US government, banking, healthcare, and IT organizations. Attackers exploit legitimate Adobe Shared Links to redirect victims to Microsoft Device Code phishing pages, potentially gaining unauthorizedChatGPTCybercriminals are exploiting AI adoption through fake applications and event invitations impersonating ChatGPT, Claude, and other popular services. ANY.RUN researchers linked 1,258 sandbox analyses to fake AIClaudeare exploiting AI adoption through fake applications and event invitations impersonating ChatGPT, Claude, and other popular services. ANY.RUN researchers linked 1,258 sandbox analyses to fake AI campaigns, withDocuSignThe attack begins with phishing emails containing malicious PDF attachments that redirect victims to fake DocuSign pages. ANY.RUN researchers uncovered obfuscated scripts and hidden authentication requests used toGoogleAttackers use fraudulent downloads to spread malware and fake event invitations to steal Microsoft 365 and Google account access. In one particularly deceptive case, a genuine Claude installer ran while hidden processesMicrosoft 365 Apps for Enterprise1. SkyW4lker: Microsoft 365 Phishing Puts US Corporate Accounts at RiskMicrosoft Defender Antimalware Platform4. WKLP: Malware Disables Microsoft Defender to Gain Persistent Remote AccessMicrosoft Entra Conditional AccessTo protect your organization: Restrict unnecessary device-code authentication through Microsoft Entra Conditional Access and investigate suspicious indicators beyond the initial alert. Use ANY.RUN's Related Threat

Countries

Franceinfostealer and remote access trojan (RAT) observed targeting government organizations in the US and France. It steals credentials, browser data, and sensitive files while allowing attackers to maintain access toUnited StatesOctober 2026 brought another wave of cyber threats targeting US businesses, with attackers exploiting trusted platforms, legitimate authentication processes, and everyday business workflows. For enterprises, these

Industries

Banking3. GeorgeGinx: Device Code Phishing Targets US Government, Banking, and HealthcareConsultingThe results revealed related activity across technology, government, education, consulting, and healthcare organizations, with submissions from the US, Latin America, and Europe. SOC teams can use the associated URLs toEducationThe results revealed related activity across technology, government, education, consulting, and healthcare organizations, with submissions from the US, Latin America, and Europe. SOC teams can use the associated URLs toGovernmentThe results revealed related activity across technology, government, education, consulting, and healthcare organizations, with submissions from the US, Latin America, and Europe. SOC teams can use the associated URLs toHealthcareThe results revealed related activity across technology, government, education, consulting, and healthcare organizations, with submissions from the US, Latin America, and Europe. SOC teams can use the associated URLs toITactivity to previous sandbox investigations and wider threat intelligence. In the SkyW4lker investigation, it helped researchers uncover additional malicious infrastructure and trace technical links to Gabagool,TechnologyThe results revealed related activity across technology, government, education, consulting, and healthcare organizations, with submissions from the US, Latin America, and Europe. SOC teams can use the associated URLs to

Related Articles