# October 2026 Campaigns: Device-Code Phishing Kits (SkyW4lker, GeorgeGinx, Mir0Auth), Fake AI Lures, and WKLP Python Infostealer/RAT

> ANY.RUN's October 2026 roundup reports OAuth device-code phishing against Microsoft 365 (SkyW4lker, GeorgeGinx PhaaS, Mir0Auth) that yields account access without password theft, fake ChatGPT/Claude lures that push paste-command (ClickFix-style) attacks, and WKLP, a Python infostealer/RAT aimed at US and French government organizations that tampers with Defender and masquerades as MoUsoCoreWorker.exe.

- **Published:** 2026-11-04T04:26:30Z
- **Last reviewed:** 2026-11-06T08:21:19.272Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5209
- **ID:** TL-2026-5209
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 16 (3 shown free below)

## Description

This record aggregates several concurrent campaigns documented in ANY.RUN's 'Major Cyber Attacks in October 2026' report (published 2026-11-03), based on public sandbox telemetry. No CVEs are involved and the source names no threat actor; attribution is therefore Unknown.

Device-code phishing. SkyW4lker is a Microsoft 365 device-code phishing kit seen in 618 sandbox analyses between June and 21 October 2026 (about 20 per month in June, about 200 in September; 46% of submissions from the US). Per ANY.RUN, the chain starts with password-protected documents posing as contracts, invoices or proposals, followed by CAPTCHA checks and trusted-platform pages, and ends with the victim entering an attacker-generated device code on Microsoft's legitimate authentication site. A secondary write-up (ayinedjimi-consultants.fr, 2026-10-28) adds that pages are hosted on Google subdomains (Sites/Docs), the code is shown in XXXXX-XXXXX form, the victim is sent to microsoft.com/devicelogin, and the attacker captures OAuth tokens including refresh tokens; that source names manufacturing, technology and healthcare as primary targets. ANY.RUN's Threat Intelligence Lookup ties IP 198.23.223.185 to 203 URLs across 10 domains and 30 sandbox analyses from 10 countries, affecting technology, government, education, finance and consulting. ANY.RUN believes SkyW4lker shares a developer with the Gabagool phishing kit. Because the victim authenticates on a real Microsoft page, MFA does not stop the compromise and no credentials are harvested.

GeorgeGinx is a phishing-as-a-service platform targeting US government, banking, healthcare and IT organizations. Legitimate Adobe Shared Links redirect victims to Microsoft device-code phishing pages; ANY.RUN reports discovering an administration panel on the attack server. Mir0Auth is a Microsoft 365 token-phishing kit: phishing emails carry PDF attachments leading to fake DocuSign pages and then Microsoft device-code authentication, with obfuscated endpoint names /task_queue.cs, /context.go and /window.rs, targeting US organizations. Related public reporting on device-code phishing describes Cloudflare Workers-hosted portals and a Storm-2372 (Russia-linked) precedent; these are context, not attribution for the October 2026 kits.

Fake AI lures. Between 15 April and 5 October 2026, ANY.RUN saw 1,258 public sandbox analyses tied to fake AI tool campaigns (fake ChatGPT, Claude and other installers, and fraudulent event invitations redirecting to Microsoft 365/Google phishing pages); 45% involved paste-command attacks, in which the victim is tricked into pasting and running a command. The US ranked second in submission activity. Outcomes include malware infection, credential theft and unauthorized account access.

WKLP is a Python-based infostealer and RAT targeting government organizations in the US and France. It collects credentials, browser data, password-manager data and sensitive files; changes Microsoft Defender exclusions via PowerShell; terminates security processes; creates firewall rules disguised as 'Windows Update Service'; supports remote execution and payload deployment and screen, camera, microphone and clipboard access; and uses a watchdog mechanism to restore itself. The legitimate Python runtime is renamed MoUsoCoreWorker.exe to blend in with the Windows Update orchestrator component.

Sourcing limits: the primary source is a single vendor; no hashes, domains or WKLP C2 indicators are published in the article text (IOCs are referenced via LinkedIn posts and sandbox sessions). The BeaconBeagle lookup for 198.23.223.185 returned HTTP 502 and could not be completed.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1078.004 Cloud Accounts
- T1204.002 Malicious File
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1685 Disable or Modify Tools
- T1686 Disable or Modify System Firewall
- T1036.005 Match Legitimate Resource Name or Location
- T1550.001 Application Access Token
- T1528 Steal Application Access Token
- T1555.003 Credentials from Web Browsers
- T1555.005 Password Managers
- T1005 Data from Local System
- T1113 Screen Capture
- T1123 Audio Capture
- T1125 Video Capture
- T1583.007 Serverless
- T1059.006 Command and Scripting Interpreter
- T1539 Steal Web Session Cookie

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**WKLP — PowerShell Microsoft Defender Exclusion Tampering (TL-2026-5209)** (`TL-2026-5209-SPL-002`)

WKLP (Python infostealer/RAT targeting US and French government organizations) changes Microsoft Defender exclusions via PowerShell before operating, often covering its renamed runtime MoUsoCoreWorker.exe. This search finds Sysmon process creation where PowerShell adds a Defender exclusion path, process or extension (T1562.001, T1059.001), flagging paths that resemble WKLP staging.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1562.001, T1059.001
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\powershell.exe" OR Image="*\\pwsh.exe") (CommandLine="*Add-MpPreference*" OR CommandLine="*Set-MpPreference*") (CommandLine="*ExclusionPath*" OR CommandLine="*ExclusionProcess*" OR CommandLine="*ExclusionExtension*")
| eval wklp_path_hint=if(match(CommandLine,"(?i)(MoUsoCoreWorker|ProgramData|AppData|Temp|\\.py)"),"path_matches_wklp_pattern","generic")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(ParentImage) as parents by host, User, wklp_path_hint
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("Add-MpPreference", "Set-MpPreference")
| where ProcessCommandLine has_any ("ExclusionPath", "ExclusionProcess", "ExclusionExtension")
| extend WklpPathHint = ProcessCommandLine has_any ("MoUsoCoreWorker", "ProgramData", "AppData", "Temp", ".py")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine, WklpPathHint
```

### Sigma

```yaml
title: PowerShell Adds Microsoft Defender Exclusion (WKLP Defender Tampering)
id: 6a2d8e14-1c53-4f7b-8a90-4b3e9d2c6f02
status: experimental
description: Detects PowerShell using Add-MpPreference or Set-MpPreference to add Microsoft Defender path, process or extension exclusions, the behaviour reported for the WKLP Python infostealer/RAT before it operates.
references:
  - https://any.run/cybersecurity-blog/major-cyber-attacks-october-2026/
author: Threadlinqs Team
date: 2026-11-04
tags:
  - attack.defense-evasion
  - attack.execution
  - attack.t1562.001
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cmd:
    CommandLine|contains:
      - 'Add-MpPreference'
      - 'Set-MpPreference'
  selection_exclusion:
    CommandLine|contains:
      - 'ExclusionPath'
      - 'ExclusionProcess'
      - 'ExclusionExtension'
  condition: selection_img and selection_cmd and selection_exclusion
falsepositives:
  - Administrators or deployment scripts adding approved Defender exclusions (SQL Server, backup agents, developer tooling)
level: high

```

**Known false positives:**

- Administrators or software deployment (SCCM, Intune, Ansible) adding approved Defender exclusions
- Developer or database servers with documented AV exclusions

**Tuning notes:** Allow-list approved exclusion paths and the management hosts or accounts that set them. Prioritise hits where wklp_path_hint is path_matches_wklp_pattern or the parent is not a management agent. Pair with Defender operational EventCode 5007 for registry-level exclusion changes. Adjust index and sourcetype to your Sysmon ingestion.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Device-Code Phishing — Token Reuse From a New IP After a Device Code Sign-In (locked: unlock with TL Creds)
- Fake AI Lure — ClickFix Paste-Command Execution Launched From Explorer (locked: unlock with TL Creds)
- Device-Code Phishing Delivery — Mir0Auth Endpoints, SkyW4lker IP and Workers-Hosted Lures (locked: unlock with TL Creds)
- WKLP — Firewall Rule Named 'Windows Update Service' Created via netsh or PowerShell (locked: unlock with TL Creds)
- WKLP — Microsoft Defender Protections Disabled or Security Processes Terminated (locked: unlock with TL Creds)
- WKLP — Non-Browser Process Access to Browser and Password-Manager Credential Stores (locked: unlock with TL Creds)
- SkyW4lker / GeorgeGinx / Mir0Auth — Entra ID Device Code Sign-In From Unmanaged Device or SkyW4lker IP (locked: unlock with TL Creds)
- WKLP — [indicator] Masquerading Outside System32 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 16)

Defanged, TLP:CLEAR.

- IP address: `198.23.223[.]185`
- Domain: `login[.]microsoftonline[.]com`
- URL: `hxxps://microsoft[.]com/devicelogin`

Full set of 16 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Major Cyber Attacks in October 2026: Fake AI, Account Takeovers, and Remote Access Threaten US and EU](https://any.run/cybersecurity-blog/major-cyber-attacks-october-2026/)
- [SkyW4lker phishing OAuth MFA M365 2026](https://ayinedjimi-consultants.fr/news/skyw4lker-phishing-oauth-mfa-m365-2026)
- [Device Code Phishing Campaign Hijacks Microsoft 365 Accounts Without Stealing Passwords](https://abnormal.ai/attack-library/device-code-phishing-campaign-hijacks-microsoft-365-accounts)
- [ClickFix has never been bigger, and AI tools are its most convincing lure yet](https://www.bleepingcomputer.com/news/security/clickfix-has-never-been-bigger-and-ai-tools-are-its-most-convincing-lure-yet/)
- [Storm-2372 used the device code phishing technique since August 2024](https://securityaffairs.com/174270/apt/storm-2372-used-device-code-phishing-technique.html)
- [Large-scale device code phishing campaign targets global sectors via OAuth abuse](https://www.cybersecurity-help.cz/blog/5376.html)
- [Madape: Microsoft device code phishing kit (Group-IB)](https://www.group-ib.com/blog/madape-microsoft-device-code-phishing-kit/)
- [Device code phishing technique (Push Security)](https://phishing-techniques.pushsecurity.com/techniques/device-code-phishing/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5209