5 Active Cyber Threats Facing US Enterprises, October 2026

What happened: trusted tools turned against US businesses

October 2026 brought a new wave of attacks on US businesses that abuse trusted platforms and normal sign-in steps. Two campaigns stand out: the SkyW4lker phishing kit and a set of fake AI app and event lures. The Hacker News report lists five threats in total, so read it in full for the other three.

SkyW4lker abuses Microsoft's legitimate device-code authentication. It compromises corporate accounts without stealing passwords or bypassing MFA. The victim enters a code on a real Microsoft page, and that code grants the attacker access.

Fake AI campaigns impersonate ChatGPT, Claude and other popular services. They use fraudulent downloads to spread malware. They also use fake event invitations to steal Microsoft 365 and Google account access.

Who is affected

Any organization with Microsoft 365 accounts is a possible target for SkyW4lker. ANY.RUN researchers found 618 related sandbox analyses between June and October 21, 2026. 46% came from the US.

Related activity touched technology, government, education, consulting and healthcare organizations. Submissions came from the US, Latin America and Europe.

The fake AI campaigns are tied to 1,258 sandbox analyses. The US ranks second worldwide and first in two major campaign groups. Companies where staff install AI tools on their own are the most exposed.

The report gives no product versions, so there is no affected-versus-fixed table. These are abuses of how sign-in and software installs work, not a single bug with a patch.

How serious it is and whether it is exploited

Both campaigns are active. The report describes real-world sandbox investigations, not theory.

The risk is high because the attacks look legitimate. SkyW4lker victims land on Microsoft's real authentication page. Phishing emails pose as contracts, invoices or business proposals. Victims also pass through CAPTCHA checks and trusted platforms first.

The fake AI case is just as sneaky. In one sample, a genuine Claude installer ran while hidden processes stole browser session cookies. Stolen cookies can let attackers into business accounts without another MFA prompt.

What to do now

1. Block device-code flow where you do not need it

The report recommends restricting unnecessary device-code authentication through Microsoft Entra Conditional Access. In the Entra admin center, create a policy that targets Authentication flows, selects Device code flow, and sets the grant to Block. Exclude only the users or devices that truly need it, such as shared-screen devices.

Check which policies already exist:

Connect-MgGraph -Scopes "Policy.Read.All"
Get-MgIdentityConditionalAccessPolicy | Select-Object DisplayName, State

2. Hunt your sign-in logs

If you use Microsoft Sentinel or Log Analytics, look for device-code sign-ins over the last 30 days. Then search for the IP address named in the report, 198.23.223.185.

SigninLogs
| where TimeGenerated > ago(30d)
| where AuthenticationProtocol == "deviceCode"
| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, ResultType, Location
| order by TimeGenerated desc

SigninLogs
| where TimeGenerated > ago(90d)
| where IPAddress == "198.23.223.185"

Most users never use device code. Any hit from an office worker on a normal laptop deserves a look.

3. Contain a suspected account

If a device-code sign-in looks wrong, cut the attacker's session first, then reset credentials. Revoking sessions also invalidates stolen refresh tokens.

Connect-MgGraph -Scopes "User.ReadWrite.All"
Revoke-MgUserSignInSession -UserId user@yourcompany.com

4. Control AI app installs

The report advises approving trusted AI applications and restricting unauthorized installations. Publish a short list of approved AI tools and where to download them. Use your endpoint management tool to block installs from anywhere else. Treat any machine that ran an unapproved installer as one where browser sessions may be stolen.

5. Use related indicators

The report says related URLs tied to the SkyW4lker IP can enrich detection and help SOC teams hunt connected threats. It also links SkyW4lker's infrastructure to another phishing kit, Gabagool. Add those indicators to your blocklists and detections after you validate them.

Worked example: triaging one device-code alert

Say your query returns a device-code sign-in for a finance user at 2 a.m. from an unfamiliar IP.

1. Check whether the user ever signs in with device code. If not, treat it as suspicious.

2. Search the IP in your logs and threat intelligence, including 198.23.223.185.

3. Revoke the user's sessions with the command above.

4. Review mailbox rules and recent file access for that account.

5. Find the original email. A fake contract or invoice is the likely start, so search for and remove copies from other inboxes.

6. Reset the password and confirm the Conditional Access block is in place.

What IT and security learners can take from this

These campaigns show that identity is the main target. You can pass every MFA check and still lose an account if you approve the wrong request. Learning Conditional Access, token handling and sign-in log analysis pays off quickly. The AZ-500 Microsoft Azure Security Engineer Associate exam covers identity and access controls in Microsoft environments. For a related threat pattern, read our post on fake GitHub security tools that push backdoors and infostealers.

If you plan to sit AZ-500, the voucher ($44.99) arrives by email within 12 hours.

Sources

• 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 (The Hacker News)