Five Active Cyber Threats Target US Enterprises in October

Five distinct cyber threats emerged in October 2026 targeting US businesses by exploiting trusted platforms and legitimate authentication flows. The campaigns leverage phishing emails, fraudulent applications, and compromised account access rather than technical exploits, affecting organizations across technology, government, education, consulting, healthcare, banking, and IT sectors.

Three phishing operations—SkyW4lker, GeorgeGinx, and Mir0Auth—abuse Microsoft’s device-code authentication to gain unauthorized corporate account access. SkyW4lker, identified in 618 sandbox analyses with 46% from the US, uses phishing emails impersonating business documents to trick users into entering device codes on legitimate Microsoft authentication pages. GeorgeGinx, a Phishing-as-a-Service operation, hides phishing redirects behind Adobe Shared Links. Mir0Auth sends malicious PDF attachments disguised as DocuSign documents to steal Microsoft 365 tokens. Separately, cybercriminals exploit AI adoption through fake applications and event invitations impersonating popular services like ChatGPT and Claude. Researchers linked 1,258 sandbox analyses to these fake AI campaigns, with the US ranking second worldwide. Attack methods include fraudulent downloads spreading malware and fake event invitations to steal Microsoft 365 and Google account access. In one case, a legitimate Claude installer ran alongside hidden processes harvesting browser cookies, potentially allowing attackers to access business accounts without additional MFA prompts.

WKLP, a Python-based malware targeting government organizations in the US and France, weakens endpoint protection by adding Microsoft Defender exclusions, terminating security processes, and creating disguised firewall rules, enabling persistent remote access and theft of credentials, browser data, and sensitive files. Collectively, these five threats demonstrate how attackers exploit legitimate business processes and platforms, creating sustained exposure to financial losses, data theft, and operational disruption.