In October 2026, a new wave of cyber threats hit US businesses, exploiting trusted platforms, legitimate authentication processes, and everyday business workflows. This campaign significantly raises the stakes beyond individual security incidents, increasing the risk of financial losses, data breaches, and costly operational disruptions. Below, we examine five active cyber threats through real-world sandbox investigations, revealing how they operate, the risks they pose to organizations, and strategies for detecting and containing attacks to minimize business impact.
Microsoft 365 Phishing Attack Targets US Corporate Accounts SkyW4lker is a cyber-attack tool that uses legitimate device-code authentication from Microsoft to infiltrate corporate accounts without requiring passwords or bypassing multi-factor authentication. SOC teams can utilize the associated URLs to enhance existing detection systems and hunt for connected threats, thereby reducing manual investigation efforts, speeding up triage, and enabling organizations to identify potential exposures before costly incidents occur. Deceptive AI Campaigns Target U.S.
GeorgeGinx: Device Code Phishing Targets US Government, Banking, and Healthcare Gathered IOC Information To uncover how GeorgeGinx hides phishing destinations behind trusted Adobe links, cybersecurity researchers utilized ANY.RUN's In-Browser Data Inspection to scrutinize HTML DOM modifications and HTTP requests. Utilize ANY.RUN's Interactive Sandbox to uncover hidden malware behavior and auto-generate a detailed Tier 1 report, providing clear evidence and response recommendations, helping teams contain threats more quickly and minimize costly incident recovery.
