5 Active Cyber Threats That Put US Enterprises at Risk in October 2026
Summary: ANY.RUN researchers documented five active campaigns in October 2026, including the SkyW4lker phishing kit, which exploits Microsoft's legitimate device-code authentication to compromise accounts without stealing passwords or bypassing MFA, and which accounted for 618 related sandbox analyses between June and October 21, 2026, with 46% from the US. The other campaigns include fake ChatGPT and Claude downloads and event invitations tied to 1,258 sandbox analyses, the GeorgeGinx phishing-as-a-service operation using Adobe Shared Links to redirect victims to Microsoft Device Code phishing pages, the WKLP Python infostealer and RAT targeting US and French government organizations, and the Mir0Auth kit using malicious PDF attachments and fake DocuSign pages to obtain Microsoft 365 tokens.
Bottom line: Four of the five campaigns bypass password theft and MFA entirely by abusing Microsoft's own device-code authentication flow, so credential hygiene and MFA enforcement do not stop them. With 46% of the 618 SkyW4lker analyses originating in the US, the question for security leaders is whether device-code authentication is restricted in their Entra Conditional Access policies today.
Read the original at The Hacker News ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026