ANY.RUN researchers describe SkyW4lker, an active tool targeting corporate Microsoft 365 accounts through device-code sign-in.
Messages posing as contracts, invoices or business proposals lead to Microsoft's genuine login page; entering a device code can give attackers unauthorized access without password theft or bypassing MFA.
The report also covers four other active threats targeting US organizations in October 2026.
SkyW4lker: Sent messages that looked like contracts, invoices, or business proposals and led to a real Microsoft login page. If the victim typed in a special code, the attackers could gain access to a corporate Microsoft 365 account without stealing the password or bypassing the additional login check. ANY.RUN identified 618 related analyses from June to October 21, 2026. 46% originated from the US.
Fake AI services: Attackers impersonated well-known services, such as ChatGPT and Claude, with fake apps and event invitations. The fake apps could install malware, while the invitations targeted access to Microsoft 365 and Google accounts. In one incident, a genuine Claude installer was executed, while hidden processes stole data from an active browser login. This could potentially allow attackers to break into corporate accounts without a new login check. Researchers linked 1.258 analyses to such scams. The US was the second largest source of submissions globally.
GeorgeGinx: This active fraud operation targeted government agencies, banks, healthcare providers, and IT companies in the U.S. The perpetrators used genuine Adobe shareable links to lead victims to fake Microsoft login pages. If the victim typed in a special code, the perpetrators could gain access to corporate accounts without stealing passwords. Investigators also found a control panel on a computer used by the perpetrators.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
320.000 records from 39 Bristol schools leaked
↗
WKLP: This program was detected targeting government organizations in the US and France. It stole login credentials, browsing data, and sensitive files, while allowing attackers to maintain access to compromised systems. To weaken protection, it added exceptions to Microsoft Defender, closed security programs, and created deceptive firewall rules.
Mir0Auth: This phishing tool targeted Microsoft 365 users, with significant activity against organizations in the US. The messages contained malicious PDF files that led to fake DocuSign pages. Hidden programs on the pages could extract digital credentials that grant access to Microsoft 365 accounts. This access could allow the attackers to view sensitive corporate communications and data.
The findings and analysis numbers come from ANY.RUN researchers and from tests in a controlled environment.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)