Five Cyber Threats Target US Enterprises Through Trusted Workflows

Five active cyber threats in October 2026 targeted US enterprises, with attackers abusing trusted platforms, legitimate authentication flows, and common business workflows to reach corporate accounts and data. SkyW4lker uses a phishing lure that ends at Microsoft’s device-code authentication page, enabling account access without stealing passwords or MFA bypass.

ANY[.]RUN researchers logged 618 sandbox analyses between June and 21 October 2026, with 46% from the US, and Related Threat Context linked the attacker’s IP to further infrastructure, including Gabagool. The firm notes Related Threat Context helps SOCs map suspicious activity to prior investigations, enriching detections and speeding containment.

GeorgeGinx, a phishing-as-a-service operation, hides redirects behind trusted Adobe links to Microsoft device-code pages, with ANY[.]RUN’s in-browser data inspection exposing hidden DOM changes and HTTP requests and an attack server administration panel; victims include US government, banking and healthcare organisations. WKLP, a Python-based infostealer and RAT, targets US and French government entities, using PowerShell and a Python runtime, disabling Defender via exclusions and firewall rules to maintain access.

Mir0Auth phishkit targets Microsoft 365, using legitimate device-code authentication to steal tokens; sessions show obfuscated scripts and hidden authentication requests redirecting to fake DocuSign pages.

ANY[.]RUN data underpinning the campaigns shows substantial US involvement and cross-sector impact, with evidence ranging from sandbox sessions to threat-in-context links. The report attributes each claim to the researchers and campaigns described, including ANY[.]RUN’s sandbox analyses, In-Browser Data Inspection findings, and TI Lookups that reveal linked infrastructure.

For protection, the article reiterates the need to restrict device-code auth, verify unexpected event invitations, and revoke compromised sessions, while highlighting the value of threat context in accelerating detection and containment.