October 2026 saw a surge in cyberattacks aimed squarely at US enterprises, exploiting standard workflows and trusted platforms to inflict financial, operational, and reputational damage. These tactics go beyond basic phishing or malware, targeting authentication flows, legitimate file-sharing services, and endpoint protections in increasingly sophisticated ways.
Key Threats Revealed
SkyW4lker (Microsoft 365 device code phishing): This phishing toolkit shifts the attack vector away from password theft. Instead, it leverages Microsoft’s device-code authentication flow. Phishing emails, disguised as contracts or proposals, lead victims through CAPTCHAs to legitimate Microsoft login pages. Once a device code is entered, attackers can gain account access, bypassing both the password and additional factors. Nearly half of analyzed SkyW4lker sandbox activities between June and mid-October originated in the US. Corporate, educational, healthcare, and consulting sectors were all targeted.
Fake AI Campaigns: As AI tools become more mainstream—like ChatGPT and Claude—adversaries are using that trend as cover. Phony app downloads and event invites spoof these popular platforms to steal credentials for Microsoft 365 and Google accounts. In one case, malware hidden behind a deceptively valid installer for Claude ran without user notice, siphoning session cookies. The US is a major hotspot for this campaign group globally.
GeorgeGinx Phishing-as-a-Service: This operation abuses Adobe Shared Links—trusted document links are used as lures and redirect users through to Microsoft device-code phishing pages. Targets include US government, banking, healthcare, and IT organizations. Analysis tools uncovered hidden redirect scripts and administrative control panels backing the campaign.
WKLP RAT and Infostealer: A more technical threat—WKLP is Python-based, and aims to both collect data and maintain long-term access. Using legitimate Python runtimes and PowerShell, it steals credentials, browser data, and sensitive files. It also actively undermines endpoint security—terminating processes, altering firewall rules, and adding exceptions in Microsoft Defender.
Mir0Auth Token Theft: Another attack on Microsoft 365 users—this phishing kit uses malicious PDFs that redirect to fake DocuSign-like pages to harvest device codes and authentication tokens. This allows attackers to hijack corporate accounts without needing passwords. Obfuscated scripting is employed to mask the authentication flow.
Mitigations & Operational Takeaways
These threats highlight how attackers are shifting to flows where they don’t need passwords—device-code auth and token theft are frequent recurring techniques. Enterprises must adapt by scrutinizing MFA exceptions and monitoring device codes closely. Blindly trusting file sharing links or app installers is becoming increasingly risky.
Security operations centers (SOCs) can reduce risk by integrating tools that provide detailed context: sandbox investigations, in-browser script inspection, and threat intelligence feeds are key. Tightening endpoint security—defender tamper protections, firewall audits—and being ready to revoke compromised sessions will limit damage once attacks succeed.
Bottom line: The October wave of attacks shows how basic assumptions—trusted platforms, MFA, or legitimate service links—can be turned against organizations. Heightened vigilance, context-aware detection, and faster response capabilities are now essential.
