Skip to navigation

Threat reportPhishingTL-2026-5209

October 2026 Campaigns: Device-Code Phishing Kits (SkyW4lker, GeorgeGinx, Mir0Auth), Fake AI Lures, and WKLP Python Infostealer/RAT

highACTIVE

ANY.RUN's October 2026 roundup reports OAuth device-code phishing against Microsoft 365 (SkyW4lker, GeorgeGinx PhaaS, Mir0Auth) that yields account access without password theft, fake ChatGPT/Claude lures that push paste-command (ClickFix-style) attacks, and WKLP, a Python infostealer/RAT aimed at US and French government organizations that tampers with Defender and masquerades as MoUsoCoreWorker.exe.

Key facts

IdentifiersTL-2026-5209
Also known asSkyW4lker, Gabagool, Mir0Auth, GeorgeGinx, WKLP
SeverityHIGH
First disclosed
Affected productsMicrosoft Microsoft 365 / Entra ID (OAuth device code flow); Microsoft Windows (WKLP target; Microsoft Defender)
MalwareGabagool, GeorgeGinx, Mir0Auth, SkyW4lker, WKLP
MITRE ATT&CK techniquesT1005 Data from Local System, T1036.005 Match Legitimate Resource Name or Location, T1059.001 PowerShell, T1059.006 Command and Scripting Interpreter, T1078.004 Cloud Accounts, T1113 Screen Capture, T1123 Audio Capture, T1125 Video Capture, T1204.002 Malicious File, T1204.004 Malicious Copy and Paste, T1528 Steal Application Access Token, T1539 Steal Web Session Cookie and 8 more in the attack flow
MotivationUNKNOWN
Target sectorsgovernment administration, technology, education, finance, banking, health, consulting, manufacturing, information-technology
Target regionsunited states of america, france, germany, colombia, Europe
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5209 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: WKLP — PowerShell Microsoft Defender Exclusion Tampering (TL-2026-5209)

WKLP (Python infostealer/RAT targeting US and French government organizations) changes Microsoft Defender exclusions via PowerShell before operating, often covering its renamed runtime MoUsoCoreWorker.exe. This search finds Sysmon process creation where PowerShell adds a Defender exclusion path, process or extension (T1562.001, T1059.001), flagging paths that resemble WKLP staging.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1562.001, T1059.001
  • Data sources: sysmon, microsoft_defender_for_endpoint
  • Severity: high
  • Confidence: high

Splunk SPL

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\powershell.exe" OR Image="*\\pwsh.exe") (CommandLine="*Add-MpPreference*" OR CommandLine="*Set-MpPreference*") (CommandLine="*ExclusionPath*" OR CommandLine="*ExclusionProcess*" OR CommandLine="*ExclusionExtension*")
| eval wklp_path_hint=if(match(CommandLine,"(?i)(MoUsoCoreWorker|ProgramData|AppData|Temp|\\.py)"),"path_matches_wklp_pattern","generic")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(ParentImage) as parents by host, User, wklp_path_hint
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("Add-MpPreference", "Set-MpPreference")
| where ProcessCommandLine has_any ("ExclusionPath", "ExclusionProcess", "ExclusionExtension")
| extend WklpPathHint = ProcessCommandLine has_any ("MoUsoCoreWorker", "ProgramData", "AppData", "Temp", ".py")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine, WklpPathHint

Sigma

title: PowerShell Adds Microsoft Defender Exclusion (WKLP Defender Tampering)
id: 6a2d8e14-1c53-4f7b-8a90-4b3e9d2c6f02
status: experimental
description: Detects PowerShell using Add-MpPreference or Set-MpPreference to add Microsoft Defender path, process or extension exclusions, the behaviour reported for the WKLP Python infostealer/RAT before it operates.
references:
  - https://any.run/cybersecurity-blog/major-cyber-attacks-october-2026/
author: Threadlinqs Team
date: 2026-11-04
tags:
  - attack.defense-evasion
  - attack.execution
  - attack.t1562.001
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cmd:
    CommandLine|contains:
      - 'Add-MpPreference'
      - 'Set-MpPreference'
  selection_exclusion:
    CommandLine|contains:
      - 'ExclusionPath'
      - 'ExclusionProcess'
      - 'ExclusionExtension'
  condition: selection_img and selection_cmd and selection_exclusion
falsepositives:
  - Administrators or deployment scripts adding approved Defender exclusions (SQL Server, backup agents, developer tooling)
level: high

Known false positives:

  • Administrators or software deployment (SCCM, Intune, Ansible) adding approved Defender exclusions
  • Developer or database servers with documented AV exclusions

Tuning notes: Allow-list approved exclusion paths and the management hosts or accounts that set them. Prioritise hits where wklp_path_hint is path_matches_wklp_pattern or the parent is not a management agent. Pair with Defender operational EventCode 5007 for registry-level exclusion changes. Adjust index and sourcetype to your Sysmon ingestion.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Device-Code Phishing — Token Reuse From a New IP After a Device Code Sign-In · unlock with TL Creds
  • Fake AI Lure — ClickFix Paste-Command Execution Launched From Explorer · unlock with TL Creds
  • Device-Code Phishing Delivery — Mir0Auth Endpoints, SkyW4lker IP and Workers-Hosted Lures · unlock with TL Creds
  • WKLP — Firewall Rule Named 'Windows Update Service' Created via netsh or PowerShell · unlock with TL Creds
  • WKLP — Microsoft Defender Protections Disabled or Security Processes Terminated · unlock with TL Creds
  • WKLP — Non-Browser Process Access to Browser and Password-Manager Credential Stores · unlock with TL Creds
  • SkyW4lker / GeorgeGinx / Mir0Auth — Entra ID Device Code Sign-In From Unmanaged Device or SkyW4lker IP · unlock with TL Creds
  • WKLP — [indicator] Masquerading Outside System32 · unlock with TL Creds

Indicators of compromise

As of 2026-11-06, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-5209.

Sample indicators (3 of 16)

  • IP address: 198.23.223[.]185
  • Domain: login[.]microsoftonline[.]com
  • URL: hxxps://microsoft[.]com/devicelogin

Defanged, TLP:CLEAR. Full set of 16 indicators: unlock with TL Creds.

16 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

This record aggregates several concurrent campaigns documented in ANY.RUN's 'Major Cyber Attacks in October 2026' report (published 2026-11-03), based on public sandbox telemetry. No CVEs are involved and the source names no threat actor; attribution is therefore Unknown.

Device-code phishing. SkyW4lker is a Microsoft 365 device-code phishing kit seen in 618 sandbox analyses between June and 21 October 2026 (about 20 per month in June, about 200 in September; 46% of submissions from the US). Per ANY.RUN, the chain starts with password-protected documents posing as contracts, invoices or proposals, followed by CAPTCHA checks and trusted-platform pages, and ends with the victim entering an attacker-generated device code on Microsoft's legitimate authentication site. A secondary write-up (ayinedjimi-consultants.fr, 2026-10-28) adds that pages are hosted on Google subdomains (Sites/Docs), the code is shown in XXXXX-XXXXX form, the victim is sent to microsoft.com/devicelogin, and the attacker captures OAuth tokens including refresh tokens; that source names manufacturing, technology and healthcare as primary targets. ANY.RUN's Threat Intelligence Lookup ties IP 198.23.223.185 to 203 URLs across 10 domains and 30 sandbox analyses from 10 countries, affecting technology, government, education, finance and consulting. ANY.RUN believes SkyW4lker shares a developer with the Gabagool phishing kit. Because the victim authenticates on a real Microsoft page, MFA does not stop the compromise and no credentials are harvested.

GeorgeGinx is a phishing-as-a-service platform targeting US government, banking, healthcare and IT organizations. Legitimate Adobe Shared Links redirect victims to Microsoft device-code phishing pages; ANY.RUN reports discovering an administration panel on the attack server. Mir0Auth is a Microsoft 365 token-phishing kit: phishing emails carry PDF attachments leading to fake DocuSign pages and then Microsoft device-code authentication, with obfuscated endpoint names /task_queue.cs, /context.go and /window.rs, targeting US organizations. Related public reporting on device-code phishing describes Cloudflare Workers-hosted portals and a Storm-2372 (Russia-linked) precedent; these are context, not attribution for the October 2026 kits.

Fake AI lures. Between 15 April and 5 October 2026, ANY.RUN saw 1,258 public sandbox analyses tied to fake AI tool campaigns (fake ChatGPT, Claude and other installers, and fraudulent event invitations redirecting to Microsoft 365/Google phishing pages); 45% involved paste-command attacks, in which the victim is tricked into pasting and running a command. The US ranked second in submission activity. Outcomes include malware infection, credential theft and unauthorized account access.

WKLP is a Python-based infostealer and RAT targeting government organizations in the US and France. It collects credentials, browser data, password-manager data and sensitive files; changes Microsoft Defender exclusions via PowerShell; terminates security processes; creates firewall rules disguised as 'Windows Update Service'; supports remote execution and payload deployment and screen, camera, microphone and clipboard access; and uses a watchdog mechanism to restore itself. The legitimate Python runtime is renamed MoUsoCoreWorker.exe to blend in with the Windows Update orchestrator component.

Sourcing limits: the primary source is a single vendor; no hashes, domains or WKLP C2 indicators are published in the article text (IOCs are referenced via LinkedIn posts and sandbox sessions). The BeaconBeagle lookup for 198.23.223.185 returned HTTP 502 and could not be completed.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1113 Screen Capture; T1123 Audio Capture; T1125 Video Capture

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location

Execution

T1059.001 PowerShell; T1059.006 Command and Scripting Interpreter; T1204.002 Malicious File; T1204.004 Malicious Copy and Paste

Initial Access

T1078.004 Cloud Accounts; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link

Credential Access

T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers; T1555.005 Password Managers

lateral-movement

T1550.001 Application Access Token

Resource Development

T1583.007 Serverless

defense-impairment

T1685 Disable or Modify Tools; T1686 Disable or Modify System Firewall

Remediation

Immediate actions

  • Block or sinkhole 198.23.223.185 and hunt for it in proxy, DNS and email logs
  • Review Entra ID sign-in logs for device code flow authentications from unfamiliar IPs, unmanaged devices or unusual times (90-day lookback) and revoke refresh tokens and sessions for affected users
  • Search endpoints for MoUsoCoreWorker.exe running from non-system paths or as a renamed Python runtime, and for firewall rules named 'Windows Update Service' that Windows Update did not create
  • Alert on unexpected Microsoft Defender exclusion changes made via PowerShell

Workarounds

  • Use Conditional Access to block the device code flow or restrict it to managed/compliant devices
  • Restrict non-interactive OAuth flows and legacy authentication
  • Monitor non-interactive OAuth connections in Entra ID logs

Longer-term hardening

  • Train users that entering a code from an email, document or web page on microsoft.com/devicelogin grants an attacker access
  • Restrict PowerShell and block pasting-and-running of commands from web pages (ClickFix-style) via endpoint policy and user awareness
  • Enable Defender tamper protection and monitor for security-process termination
  • Use browser/DOM-level inspection and sandbox detonation for password-protected attachments and CAPTCHA-gated pages

Affected and fixed versions

  • Microsoft — Microsoft 365 / Entra ID (OAuth device code flow)
    Vulnerable versions: Tenants permitting the device code flow without Conditional Access restriction
  • Microsoft — Windows (WKLP target; Microsoft Defender)
    Vulnerable versions: Windows endpoints where Defender exclusions can be modified by the infected user context

Timeline

Last updated · revalidated 1× · latest source

  • Abnormal AI documents a related device-code phishing campaign using a Cloudflare Workers-hosted fake document portal against Microsoft 365 accounts (background context, not attributed to the October kits).
  • Start of the window in which ANY.RUN observes 1,258 public sandbox analyses of fake AI tool (ChatGPT, Claude and others) campaigns.
  • SkyW4lker device-code phishing first appears in sandbox telemetry in June 2026 (month-level date), at about 20 submissions per month.
  • SkyW4lker submissions grow to about 200 per month by September 2026 (month-level date).
  • End of the fake AI lure observation window; 45% of the 1,258 analyses involved paste-command attacks and US ranked second in submissions.
  • End of ANY.RUN's SkyW4lker observation window: 618 analyses, 46% from the US; IP locked-ioc-4 tied to 203 URLs across 10 domains.
  • Secondary analysis of SkyW4lker published, describing Google-hosted pages, device codes and OAuth refresh-token capture.
  • ANY.RUN publishes the October 2026 roundup covering SkyW4lker, GeorgeGinx, Mir0Auth, fake AI lures and WKLP.
  • The Hacker News republishes the ANY.RUN-based roundup of five active threats, adding that a fake Claude installer uses hidden processes to steal browser session cookies for session replay.

Update history

Sources cited

Previous and next in phishing

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats