Device Code Phishing Drove October’s Five-Threat Roundup

Three of the five threats in ANY.RUN's October 2026 roundup for US enterprises are device code phishing kits. They take Microsoft 365 accounts on Microsoft's own login page, without a stolen password and without breaking MFA. The Hacker News ran the roundup on November 5, 2026, as a contributed partner piece, and the mechanics matter more than the headline numbers.

What did ANY.RUN's October roundup report?

The roundup is a vendor briefing, not newsroom reporting on a named breach. Its final line labels it a contributed piece from one of The Hacker News’s partners. That partner is sandbox vendor ANY.RUN, the content rests on its own sandbox investigations, and each threat section doubles as a pointer to one of its products.

Five threats are profiled: the SkyW4lker phishing kit, a cluster of fake AI campaigns, the GeorgeGinx phishing-as-a-service operation, the WKLP infostealer and remote access trojan, and the Mir0Auth Microsoft 365 phishing kit.

What the piece leaves out is just as useful. There is no CVE, no CVSS score and nothing to patch. ANY.RUN names no nation-state sponsor, no APT group, no victim organization, no count of compromised accounts and no financial loss. You cannot brief impact or attribution from this text.

The closing statistics are sales copy: 94% faster triage, 21 minutes less mean time to respond per incident, 30% fewer Tier 1 to Tier 2 escalations, and 30% unique malicious IOCs. The text offers no sample, baseline or independent measurement behind any of them. Keep them out of board slides and incident reports.

Why are three of the five the same device code phishing attack?

SkyW4lker, GeorgeGinx and Mir0Auth all steer a user into finishing Microsoft’s legitimate device-code sign-in for a code the attacker already holds. The user authenticates on Microsoft’s real page, MFA included. Tokens go to whoever requested the code, which is the attacker. Nothing is phished from a fake form; the user simply authorizes the wrong party.

The mechanism is the OAuth device authorization grant, built for hardware without a usable keyboard, such as TVs and meeting-room devices. The device shows a short code, a person enters it in a browser on a trusted login page, and the device receives tokens. The kits exploit that split: the person approving and the client receiving are different parties.

SkyW4lker lures arrive as email disguised as contracts, invoices or business proposals. The victim clears a CAPTCHA, passes through trusted platforms and lands on Microsoft’s real authentication page to enter the attacker’s code. ANY.RUN counted 618 related sandbox analyses between June and October 21, 2026, 46% of them from the US.

That is 618 analyses, not 618 victims, and the roundup gives no split between unique targets and repeat submissions. Pivoting from one sandbox session to a single IP address, ANY.RUN tied SkyW4lker to wider infrastructure and to a second kit, Gabagool. Related activity touched technology, government, education, consulting and healthcare across the US, Latin America and Europe.

GeorgeGinx is sold as a service and aimed at US government, banking, healthcare and IT organizations. It hides device-code pages behind legitimate Adobe Shared Links, so the first domain a user sees belongs to Adobe. While inspecting DOM changes and HTTP requests behind those links, ANY.RUN researchers found an administration panel on an attack server. No further panel detail is published.

Mir0Auth starts with phishing email carrying PDF attachments that redirect to fake DocuSign pages. ANY.RUN reports obfuscated scripts and hidden authentication requests that obtain Microsoft 365 tokens, with significant activity against US organizations. The roundup gives no dates or victim counts for it.

Treat the three as one identity failure. Contract lures, Adobe links and DocuSign-themed PDFs are the delivery; the device-code grant is the shared sink. Govern that grant and all three kits lose their payoff. Hunt them as three separate families and you chase lures while the sink stays open.

On our identity engagements, device-code phishing is usually the cheapest MFA bypass to demonstrate, because no fake login page is needed. An Entra ID security assessment that stops at admin roles will miss it, and OAuth and OIDC security testing should cover the device authorization grant, not only redirect_uri bugs.

How do you check your tenant for device code phishing?

Start in the Entra sign-in logs, not with the kit names. A successful SkyW4lker, GeorgeGinx or Mir0Auth phish ends in a device-code sign-in, and Entra records the authentication protocol for each sign-in. The table lists where to filter, plus the indicators the roundup itself names.

Source	Field or name	What to look for
Entra sign-in logs	Authentication protocol: Device code (deviceCode in Log Analytics)	Any user who does not operate meeting-room or kiosk hardware
Entra sign-in logs	Application ID on device-code sign-ins	Clients you did not expect for that user
Entra audit logs	Activity: Consent to application	New consents close in time to a device-code sign-in
Conditional Access	Authentication flows condition: device code flow	Whether any policy blocks it outside an allowlist
Endpoint (WKLP)	Process name MoUsoCoreWorker.exe	Python activity under that name, or an unexpected parent
Threat intel	SkyW4lker, GeorgeGinx, Mir0Auth, Gabagool	Kit names in TI lookups and mail-filter verdicts

ANY.RUN’s write-up cites one SkyW4lker IP address. We do not reproduce infrastructure indicators; pull current ones from your own intelligence source, since a single address from a vendor post ages fast.

A device-code sign-in from an office worker is not proof of compromise, but in most tenants it is rare enough to review by hand. Correlate each one with mail the user received in the preceding hour, especially PDF attachments and Adobe Shared Links.

What is the fake-AI cluster, including the trojanized Claude installer?

The fake-AI cluster is a different attack: malware and session theft rather than device-code abuse. Attackers use fraudulent downloads and fake event invitations that impersonate ChatGPT, Claude and other popular services. ANY.RUN linked 1,258 sandbox analyses to these campaigns, with the US second worldwide as a source of submissions and first in two major campaign groups.

Again, these are submissions, not victims. The roundup does not name the campaign groups or the other countries, or say how many analyses ended in account takeover. The fake invitations target Microsoft 365 and Google account access; the fraudulent downloads deliver malware.

In the case ANY.RUN highlights, a genuine Claude installer ran while hidden processes stole browser session cookies. A stolen session cookie is an already authenticated session, so the attacker can reach business accounts without triggering another MFA prompt. The write-up calls the sample trojanized and does not say Anthropic’s download channel was involved. Treat it as a repackaged download.

This is not prompt injection or a model jailbreak. A user ran software that looked like a product they trust, and a side process read browser storage. Containment is identity work: revoke the affected user’s sessions and refresh tokens in Entra or Google Workspace, because a password reset alone may leave a live session usable.

Prevention sits with endpoint and procurement: approve the AI clients staff may install, block the rest, and verify unexpected event invitations. An AI supply chain security audit covers where AI tools come from and what they can reach. A phishing simulation that only scores password entry misses this cluster and the device-code kits, since neither asks for a password.

What does WKLP change on the endpoint?

WKLP attacks the endpoint, not the cloud token. ANY.RUN describes it as a Python-based infostealer and remote access trojan seen against government organizations in the US and France. It steals credentials, browser data and sensitive files and keeps remote access to the host. No victims are named, so the government focus is a targeting claim, not a breach list.

Execution runs through PowerShell and a legitimate Python runtime. The malware then blinds the host: it adds Microsoft Defender exclusions, terminates security processes and creates disguised firewall rules. Defender stays installed but stops seeing the process that matters.

ANY.RUN caught the malicious Python activity running under the name MoUsoCoreWorker.exe, a process name Windows Update uses. Hunt on the mismatch: a process with that name whose image path or parent does not match the genuine Windows component, or that hosts a Python runtime.

None of this needs a WKLP signature. Enforce Defender Tamper Protection through enterprise policy and alert when a device reports it off. Alert on new exclusions, killed security processes and firewall rules created outside change control. Route WKLP to endpoint detection owners; Conditional Access does nothing against a RAT already on the workstation.

What should a US enterprise change this week?

Block the device-code flow in Entra Conditional Access for everyone who does not need it. Inventory the legitimate users first; meeting-room devices and a few legacy clients are the usual cases. That one policy removes the payoff for SkyW4lker, GeorgeGinx and Mir0Auth together.

Where you cannot block yet, require a compliant device for the remaining users and alert on every device-code sign-in. On suspected compromise, revoke sessions and refresh tokens rather than relying on a password change, then review sign-ins and app consents for the same window.

• Device-code flow blocked, or limited to a named allowlist, in Conditional Access.
• Session and refresh-token revocation written into the compromise runbook ahead of password reset.
• Mail rules that detonate PDFs chaining to e-signature pages and inspect the redirect behind Adobe Shared Links.
• An approved list of AI clients, with unapproved installers blocked.
• Tamper Protection enforced, with alerts on Defender exclusions, killed security processes, new firewall rules and MoUsoCoreWorker.exe anomalies.

Brief it accurately. The lures borrow Adobe, DocuSign, Anthropic and OpenAI branding; nothing in the roundup says those companies were breached. Quote no CVE, loss figure or attribution, because the source contains none.

FAQ

What is Microsoft device code phishing?

It abuses the OAuth device authorization grant. The attacker requests a sign-in code and persuades the victim to enter it on Microsoft's genuine login page. The victim signs in normally, MFA included, and Microsoft issues tokens to the attacker's client. No password is stolen and no MFA prompt is defeated.

What is the SkyW4lker phishing kit?

A device-code phishing kit using contract, invoice and proposal lures, a CAPTCHA and trusted platforms to route victims to Microsoft's real sign-in page. ANY.RUN counted 618 related sandbox analyses from June to October 21, 2026, 46% from the US, and linked its infrastructure to a kit called Gabagool.

How do I block device code authentication in Entra ID?

Create a Conditional Access policy using the authentication flows condition to block the device code flow, excluding only the users or devices that need it. Then filter sign-in logs for the Device code authentication protocol to confirm nothing unexpected still succeeds.

Is a trojanized Claude installer stealing session cookies?

ANY.RUN reports one sample where a genuine Claude installer ran while hidden processes stole browser session cookies for Microsoft 365 and Google accounts. The roundup does not say Anthropic's official channel was compromised. Revoke sessions and refresh tokens for anyone who ran an unofficial installer.

What is WKLP malware targeting US government?

WKLP is a Python-based infostealer and remote access trojan that ANY.RUN observed against government organizations in the US and France. It adds Defender exclusions, kills security processes, creates disguised firewall rules and ran under the MoUsoCoreWorker.exe process name.

If device-code grants, Adobe and DocuSign lures, or session theft from installers are in scope for your tenant, agent::offense can test the flow the way these kits do: an OAuth and OIDC test against the live Conditional Access policy, with session revocation checked after a successful grant.