“ANY.RUN researchers identified 618 related sandbox analyses between June and October 21, 2026, with 46% coming from the US.” That single figure, lifted from recent sandbox investigations, frames a month in which familiar enterprise tools and workflows became the pathway for several active campaigns against U.S. organizations.
SkyW4lker and device-code phishing against Microsoft 365
SkyW4lker is a phishing kit that leverages legitimate Microsoft device-code authentication to gain access to corporate Microsoft 365 accounts without stealing passwords or directly bypassing MFA. ANY.RUN research tied 618 sandbox sessions to the kit and found nearly half originated from the United States. Attackers deliver phishing emails disguised as contracts, invoices, or proposals; victims complete CAPTCHA and trusted-platform steps, then enter a device code on a Microsoft authentication page — a step that can hand attackers session access.
ANY.RUN’s Related Threat Context capability accelerated investigation of SkyW4lker by pivoting from a sandbox session to TI Lookup for IP 198.23.223.185, revealing related URLs and links to a separate phishing kit, Gabagool. The vendor recommends restricting unnecessary device-code authentication via Microsoft Entra Conditional Access and using Related Threat Context to harvest IOCs for proactive detection.
Fake AI campaigns that steal credentials via downloads and events
Adoption of AI tools has opened a new vector: fake applications and event invitations impersonating ChatGPT, Claude, and other services. ANY.RUN linked 1,258 sandbox analyses to such fake-AI campaigns, with the United States second in global submission volume. Tactics include fraudulent installers and deceptive event invites that harvest Microsoft 365 and Google credentials.
In one highlighted case, a genuine Claude installer ran while hidden processes stole browser session cookies — a technique that could allow attackers to reuse authenticated sessions and access business accounts without triggering additional MFA prompts. The recommended mitigations are to approve trusted AI applications, restrict unauthorized installs, and verify unexpected event invitations, while using interactive sandboxing to expose the hidden activity.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildGeorgeGinx, Mir0Auth and the reuse of trusted platforms
Two distinct phishing operations studied in October illustrate how attackers hide malicious destinations behind trusted services. GeorgeGinx, described as a Phishing-as-a-Service operation, used legitimate Adobe Shared Links to redirect victims to Microsoft device-code phishing pages, with targets in government, banking, healthcare, and IT. Investigators used in-browser data inspection to expose hidden redirects, DOM changes, and HTTP requests, and even found an administration panel on an attack server.
Mir0Auth similarly targets Microsoft 365 users by stealing access tokens rather than passwords. The Mir0Auth campaign began with phishing emails containing malicious PDF attachments that redirected victims to fake DocuSign pages; the researchers found obfuscated scripts and concealed authentication requests used to obtain tokens. ANY.RUN recommends monitoring suspicious device-code authentication and revoking compromised sessions, and keeping detection systems updated with malicious URLs provided by threat feeds.
WKLP: malware that weakens endpoint defenses to persist
WKLP is a Python-based infostealer and remote access trojan observed targeting government organizations in the United States and France. The malware exfiltrates credentials, browser data, and sensitive files and provides persistent remote access by executing malicious code through PowerShell and a legitimate Python runtime. WKLP also adds Microsoft Defender exclusions, terminates security processes, and creates disguised firewall rules — behaviors that increase the risk of prolonged compromise and data theft.
Practical detection points from the sandbox work include monitoring for unauthorized security exclusions, suspicious PowerShell execution, and unexpected firewall rule creation. The research recommends enabling Microsoft Defender Tamper Protection and using interactive sandboxing to generate Tier 1 reports with concrete evidence and response steps.
What this means for CISOs, SOC teams, and end users
- CISOs and procurement leaders: prioritize policies that limit unnecessary device-code authentication and formalize application approval for AI tools; insist on threat feed integration so detection systems receive the malicious URLs and domains discovered in real-world sandboxing.
- SOC teams and technologists: use sandbox-derived context — Related Threat Context, In-Browser Data Inspection, and interactive sandboxes — to reduce manual triage. ANY.RUN’s cited operational benefits include 94% faster triage, 21 minutes less MTTR per incident, 30% fewer Tier 1-to-Tier 2 escalations, and 30% unique malicious IOCs from customer sandbox investigations.
- End users and business employees: treat unexpected event invitations and document links with caution, verify installers before running them, and be aware that legitimate-looking services and attachments (Adobe links, DocuSign-style PDFs, AI installers) have been used as lures.
October’s research underscores a persistent truth: attackers are not only exploiting software flaws, they are exploiting trust — in authentication flows, in shared-document platforms, and in the convenience of AI tooling. The sandbox investigations offer actionable detection points and operational gains that, according to the research, can reduce investigation time and limit business impact without expanding SOC headcount. The remaining question for affected organizations is operational: how quickly can those detection and access controls be applied to the specific authentication methods and sharing services now weaponized in the wild?
