Microsoft Device-Code Phishing and Fake AI Lures Enable Account Theft and Remote Access

Phishing and malware campaigns reported by ANY.RUN targeted US enterprises, Microsoft 365 users, and government organizations in the United States and France during October 2026. SkyW4lker, GeorgeGinx, and Mir0Auth abused Microsoft’s legitimate device-code authentication process to gain unauthorized account access without stealing passwords. Separate campaigns impersonated AI services, including ChatGPT and Claude, to distribute malware, steal credentials and sessions, and trick employees into executing malicious commands.

The report also detailed WKLP, a Python-based information stealer and remote access trojan that stole sensitive data, tampered with Microsoft Defender, and used a watchdog mechanism to restore deleted malware copies. Recommended defenses include restricting unnecessary device-code authentication, investigating suspicious token activity and redirect chains, and controlling software sources and script execution. Compromised endpoints also require checks for persistence and restoration of security settings altered by malware.