Microsoft device code phishing: 3 kits that skip your password

Three phishing kits active in October 2026, SkyW4lker, GeorgeGinx and Mir0Auth, are built to get into Microsoft 365 accounts through Microsoft device code phishing on the real Microsoft sign-in page. Your staff pass MFA, the attacker walks away with a working session, and a password reset afterward may not lock them out.

What landed in inboxes in October 2026?

Five threat clusters, according to a round-up The Hacker News published on 5 November 2026. It is a contributed partner piece written with ANY.RUN, the sandbox vendor whose customers submitted the samples and which also sells the tooling the article recommends.

Read the numbers accordingly. Every figure below counts sandbox analyses, meaning files and links someone uploaded for inspection. None of them counts confirmed breaches.

The five clusters:

• SkyW4lker: a phishing kit that abuses Microsoft’s device-code login.
• Fake AI downloads and event invitations impersonating ChatGPT, Claude and similar services.
• GeorgeGinx: a phishing-as-a-service operation that hides device-code pages behind Adobe Shared Links.
• WKLP: a Python infostealer and remote access trojan seen against US and French government bodies.
• Mir0Auth: a kit that uses PDF attachments and fake DocuSign pages to collect Microsoft 365 tokens.

The gaps matter for planning. The piece names no CVEs, affected versions, file hashes, domain lists, victims or criminal groups. There is nothing to patch. Your defense is behavioral, and most of the evidence sits in your identity logs.

Why does Microsoft device code phishing still work when MFA is on?

It works because the victim really does sign in, on Microsoft’s real page, with their real MFA. The attacker simply ends up holding the result.

Device-code flow exists for hardware without a proper keyboard, such as a smart TV, a meeting room display or a command-line tool. The device shows a short code. You open Microsoft’s device login page on your phone or laptop, type the code and approve. Microsoft then issues tokens to whichever device requested that code.

In the phishing version, the attacker starts the flow from their own machine, receives the code, and puts it in front of you with a pretext. You enter it on a genuine Microsoft page and pass MFA. The access and refresh tokens go to the attacker.

A URL filter has no fake login page to catch, and there is no password to reuse and no MFA to defeat. ANY.RUN’s summary of SkyW4lker puts it plainly: the kit compromises corporate accounts “without stealing passwords or bypassing MFA.”

SkyW4lker’s chain runs like this:

1. An email posing as a contract, invoice or business proposal lands in the inbox.
2. A CAPTCHA screens the visitor, which also keeps automated scanners out.
3. The victim is routed through well-known third-party sites before reaching the Microsoft page.
4. Microsoft’s real authentication page asks for a code.

ANY.RUN logged 618 related analyses between June and 21 October 2026, and 46% of them came from the US. A pivot from the kit’s infrastructure turned up related submissions from technology, government, education, consulting and healthcare organizations in the US, Latin America and Europe.

The vendor also claims technical links to Gabagool, another phishing kit, but gives no detail. Device-code phishing itself has been publicly documented for years. What October shows is the trick packaged into kits that anyone can rent or run.

How do GeorgeGinx and Mir0Auth disguise the same trick?

They change the wrapper and keep the mechanism.

GeorgeGinx is described as an active phishing-as-a-service operation aimed at US government, banking, healthcare and IT organizations. It sends victims through legitimate Adobe Shared Links that redirect to a Microsoft device-code phishing page. Email filters and people both tend to trust an Adobe domain, and that trust is what the operators are buying.

ANY.RUN says it inspected the page changes and HTTP requests behind one Adobe link and found an administration panel on the attack server. Phishing-as-a-service backends are often less polished than the lures, and a panel like that is where an operator’s mistake gives researchers a foothold.

Mir0Auth starts with a PDF attachment. The PDF sends victims to a fake DocuSign page, where obfuscated scripts and hidden authentication requests harvest Microsoft 365 access tokens. ANY.RUN reports significant activity against US organizations.

The article’s advice for the Adobe angle is sound: “Don’t trust document-sharing links based on their domain alone.” For staff, a narrower rule is easier to remember. No supplier or client needs you to type a code into a Microsoft page so you can read a contract. If a document asks for a code, stop and call IT.

That single pattern belongs in your next round of phishing simulation, because a password-focused training deck never covers it.

What should you check in Entra this week?

First find out whether anyone in your tenant actually uses device-code sign-in, then block it for everyone who does not.

1. Search the sign-in logs. In the Microsoft Entra admin center, open the sign-in logs, add the Authentication Protocol filter and select device code. Check non-interactive sign-ins too, because token activity after the theft tends to show up there. Legitimate hits are usually a handful of admins running CLI tools, or meeting room hardware. A finance user with a device-code sign-in from an unfamiliar country or a hosting provider should be treated as an incident.
2. Restrict the flow with Conditional Access. Conditional Access policies include an authentication flows condition that can block device code flow. Build a policy that blocks it for all users and excludes a named group for the people and devices that genuinely need it. Run it in report-only mode for a week, then enforce it. Conditional Access requires Entra ID P1, which is included in Microsoft 365 Business Premium. If your plan lacks it, this attack is a good reason to review the upgrade.
3. Revoke, then reset. If a user says they typed a code, use Revoke sessions on their user page in Entra first. That invalidates refresh tokens. Then reset the password and look for anything added since the suspicious sign-in: new MFA methods, inbox rules, mail forwarding and OAuth app consents.

Order matters. A password reset alone is not a dependable way to kill tokens that have already been issued. Revocation is the control built for that job.

A hijacked mailbox is also a ready-made platform for invoice fraud. If payment details or supplier threads have been touched, treat it as business email compromise recovery, not a simple password incident.

Are fake ChatGPT and Claude downloads a separate problem?

Partly. Half of the fake-AI cluster is the same account theft described above, and the other half lands malware on the laptop.

ANY.RUN links 1,258 sandbox analyses to campaigns impersonating ChatGPT, Claude and other popular AI services. The US was the second-largest source of submissions worldwide and ranked first in two of what ANY.RUN calls its major campaign groups.

The campaigns come in two styles. Fraudulent downloads deliver malware. Fake event invitations try to steal Microsoft 365 and Google account access, which puts them in the same family as the kits above.

In one download sample, a genuine Claude installer ran normally while hidden processes stole browser session cookies. The user got the app they wanted and saw nothing wrong. A stolen session cookie represents a sign-in that already happened, so an attacker can replay it and reach business accounts without triggering a new MFA prompt.

Trojanized installers are an old lure. Pairing one with the real app makes it far harder for the user to notice anything.

Find out where your staff got their AI desktop apps. They should come from the vendor’s official site or your managed software catalog. Treat any machine that got one from a search ad, a social post or an email link as suspect and investigate it, much as you would check laptops after a malicious Claude-themed install.

Sign those users out everywhere (Entra and Google Workspace both let admins force this), rotate passwords from a clean device, and check for new MFA methods. Uninstalling the AI app does not remove whatever ran alongside it.

What WKLP does to a Windows PC

WKLP switches off parts of your defense before it starts stealing. ANY.RUN describes it as a Python-based infostealer and remote access trojan seen against government organizations in the US and France. It takes credentials, browser data and sensitive files, and it keeps persistent access.

What makes it worth an SMB’s attention is the preparation. WKLP adds Microsoft Defender exclusions, terminates security processes and creates firewall rules with disguised names. It runs through PowerShell and a legitimate Python runtime, and ANY.RUN caught its malicious Python activity posing as MoUsoCoreWorker.exe, the name of a real Windows Update component.

From our engagements: the Defender exclusion list is one of the first places we look and one of the most neglected. We regularly find exclusions for whole user folders that someone added years ago to quiet a false positive. That is the same blind spot WKLP creates on purpose.

Review exclusions centrally in the Defender portal or Intune, or on a single machine by checking ExclusionPath and ExclusionProcess in Get-MpPreference. Any exclusion nobody can explain is a finding.

Other clues on an endpoint:

• Recently added firewall rules with generic or Windows-sounding names.
• MoUsoCoreWorker.exe running from anywhere other than System32, or with python.exe as its parent or child.
• A Python runtime on the PC of someone who does not write code.
• Defender components stopped without an admin change ticket.

Turn on Tamper Protection, which exists to block exactly these unauthorized changes to Defender settings. If nobody on your team has time to watch for these signals, managed detection and response puts analysts on the alerts that WKLP is designed to silence.

What should an SMB do before the next invoice email?

Work through the identity checks first, because they cover three of the five threats. That holds even if you are not a US enterprise: the mechanism ignores geography, and SkyW4lker’s related activity already reaches Europe and Latin America.

• Search Entra sign-in logs for device-code authentication since June 2026.
• Block device-code flow with Conditional Access, excluding only a named group.
• Write down your first-hour playbook: revoke sessions, reset the password, then audit MFA methods, inbox rules and app consents.
• Tell staff that a document asking for a Microsoft code is always a reason to call IT.
• Audit Defender exclusions, enable Tamper Protection and confirm where AI apps were installed from.

Leave the closing numbers out of your planning. The article promotes 94% faster triage, 21 minutes less mean time to respond per incident, 30% fewer Tier 1 to Tier 2 escalations and 30% “unique” malicious indicators. These are self-reported vendor claims with no published methodology.

What the piece cannot tell you is how many organizations were actually compromised, who runs these kits, or what the Gabagool link amounts to. With no hashes or domain lists published, you cannot block your way out. You catch this by watching how sign-ins happen.

FAQ

Does Microsoft device code phishing bypass MFA?

It does not break MFA. The victim completes MFA on Microsoft's real page, and the resulting tokens go to the attacker who started the sign-in. In the logs it looks like a successful, legitimate authentication.

Is SkyW4lker the same as GeorgeGinx or Mir0Auth?

No. ANY.RUN describes them as separate kits that share one mechanism. SkyW4lker uses invoice and contract emails with a CAPTCHA, GeorgeGinx hides behind Adobe Shared Links, and Mir0Auth uses PDF attachments and fake DocuSign pages.

Should we block Adobe Shared Links?

Blocking a legitimate business service usually causes more friction than it prevents. Restrict device-code sign-in instead, and train staff that a shared document asking for a Microsoft code is always suspicious.

Is a real Claude installer safe if it came from a fake AI site?

No. In one case ANY.RUN observed, the genuine installer ran while hidden processes stole browser session cookies. Treat the machine as suspect and investigate it, sign the user out everywhere and rotate passwords from a clean device.

Should we revoke Microsoft 365 sessions after a phishing click?

Yes, if a user entered a code or credentials. Revoking sessions invalidates refresh tokens the attacker may already hold, which a password reset alone may not do. Do it first, then reset the password and audit the account.

If someone on your team typed a code they shouldn’t have, or you find sign-ins you can’t explain, our account takeover recovery team can revoke the attacker’s access and trace what they touched.