SkyW4lker phishing kit abuses Microsoft device-code authentication
Original title: Major Cyber Attacks in October 2026: Fake AI, Account Takeovers, and Remote Access Threaten US and EU
SkyW4lker, GeorgeGinx and Mir0Auth compromise Microsoft 365 accounts via legitimate device-code flows in October 2026.
ANY.RUN reports phishing campaigns using SkyW4lker and related kits targeting US enterprises and Microsoft 365 users. Attackers bypass MFA by abusing device-code authentication on password-protected documents. Fake AI campaigns and WKLP remote access tools also spread malware.
Unconfirmed: Exact number of successful real-world compromises not stated
- 46% of SkyW4lker submissions from the US
- 618 sandbox analyses from June to October 2026
- US ranks second in fake AI submissions
Impact: unauthorized Microsoft 365 account access
- Vendors
- Microsoft
- Products
- Microsoft 365
- Threat actors
- SkyW4lker
- Malware
- GeorgeGinxMir0AuthWKLP
- Victims
- US enterprises
- Countries
- US
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 198.23.223.185 | ly into ANY.RUN’s Threat Intelligence Lookup for IP address 198.23.223.185, expanding the investigation beyond the initial phishing UR |
From the original article
9 min read at any.run
October 2026 brought another wave of cyber threats targeting US enterprises, exposing security gaps that could lead to financial losses, data breaches, and business disruption. Attackers exploited trusted platforms, legitimate authentication processes, and growing AI adoption to gain access to corporate accounts and systems, making early detection and containment increasingly difficult. For SOC teams, these […]
any.run
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.