Five Phishing and Malware Campaigns Exploiting Device-Code Auth and Trusted Platforms Target US Enterprises
ANY.RUN researchers detail five active threat campaigns observed through sandbox investigations between June and October 2026, primarily targeting US enterprises across government, banking, healthcare, education, consulting, and technology sectors. The campaigns largely abuse Microsoft's legitimate Device Code authentication flow to hijack corporate accounts without stealing passwords or triggering MFA, alongside AI-themed lures and a Python-based infostealer/RAT that disables Microsoft Defender. These techniques allow attackers to bypass traditional credential-theft detection and gain persistent access to sensitive business systems.
Detalhes técnicos
- SkyW4lker: a phishing kit abusing Microsoft 365 device-code authentication, identified in 618 sandbox analyses (46% from the US); linked to infrastructure shared with another kit, Gabagool, via IP 198.23.223.185.
- Fake AI Campaigns: impersonate ChatGPT, Claude, and other AI tools via fraudulent installers and event invites; one case used a genuine Claude installer running alongside hidden processes stealing browser session cookies to hijack Microsoft 365/Google accounts (1,258 linked sandbox analyses, US ranked second worldwide).
- GeorgeGinx: a Phishing-as-a-Service operation abusing legitimate Adobe Shared Links to redirect victims to Microsoft Device Code phishing pages, targeting US government, banking, healthcare, and IT sectors; an administration panel was found on the attacker's server.
- WKLP: a Python-based infostealer/RAT targeting government organizations in the US and France; uses PowerShell and a legitimate Python runtime, adds Microsoft Defender exclusions, kills security processes, and creates disguised firewall rules.
- Mir0Auth: a phishing kit targeting Microsoft 365 users via malicious PDF attachments redirecting to fake DocuSign pages, using obfuscated scripts to steal device-code authentication tokens.
Remediação
Restrict unnecessary device-code authentication via Microsoft Entra Conditional Access; approve only trusted AI applications and verify unexpected event invitations; avoid trusting document-sharing links based on domain alone; enable Microsoft Defender Tamper Protection and monitor for unauthorized exclusions, suspicious PowerShell activity, and firewall changes; monitor and revoke suspicious device-code sessions; and use sandbox/threat intelligence tools to enrich detection with fresh IOCs.
Linha do tempo
-
Five Phishing and Malware Campaigns Exploiting Device-Code Auth and Trusted Platforms Target US Enterprises
ler a análise desta fonte ocultar
ANY.RUN researchers detail five active threat campaigns observed through sandbox investigations between June and October 2026, primarily targeting US enterprises across government, banking, healthcare, education, consulting, and technology sectors. The campaigns largely abuse Microsoft's legitimate Device Code authentication flow to hijack corporate accounts without stealing passwords or triggering MFA, alongside AI-themed lures and a Python-based infostealer/RAT that disables Microsoft Defender. These techniques allow attackers to bypass traditional credential-theft detection and gain persistent access to sensitive business systems.
Technical Details
- SkyW4lker: a phishing kit abusing Microsoft 365 device-code authentication, identified in 618 sandbox analyses (46% from the US); linked to infrastructure shared with another kit, Gabagool, via IP 198.23.223.185.
- Fake AI Campaigns: impersonate ChatGPT, Claude, and other AI tools via fraudulent installers and event invites; one case used a genuine Claude installer running alongside hidden processes stealing browser session cookies to hijack Microsoft 365/Google accounts (1,258 linked sandbox analyses, US ranked second worldwide).
- GeorgeGinx: a Phishing-as-a-Service operation abusing legitimate Adobe Shared Links to redirect victims to Microsoft Device Code phishing pages, targeting US government, banking, healthcare, and IT sectors; an administration panel was found on the attacker's server.
- WKLP: a Python-based infostealer/RAT targeting government organizations in the US and France; uses PowerShell and a legitimate Python runtime, adds Microsoft Defender exclusions, kills security processes, and creates disguised firewall rules.
- Mir0Auth: a phishing kit targeting Microsoft 365 users via malicious PDF attachments redirecting to fake DocuSign pages, using obfuscated scripts to steal device-code authentication tokens.
Remediation
Restrict unnecessary device-code authentication via Microsoft Entra Conditional Access; approve only trusted AI applications and verify unexpected event invitations; avoid trusting document-sharing links based on domain alone; enable Microsoft Defender Tamper Protection and monitor for unauthorized exclusions, suspicious PowerShell activity, and firewall changes; monitor and revoke suspicious device-code sessions; and use sandbox/threat intelligence tools to enrich detection with fresh IOCs.