Attackers are using Microsoft's real sign-in page to take over work accounts. No password is stolen, and one rushed code entry by an employee can be enough.
Researchers say several active phishing campaigns in October 2026 trick employees into approving a stranger's access to their Microsoft work account. The page looks genuine because it is genuine. The attackers abuse a real Microsoft sign-in step, so no password is stolen and the usual warning signs are missing.
Three of the five threats described rely on Microsoft's device-code sign-in. This is a feature where a person types a short code into a Microsoft page to approve a login. In these attacks, the victim types in a code the attacker supplied. That can give the attacker access to the account without a stolen password and without bypassing multi-step login.
The kits are called SkyW4lker, GeorgeGinx and Mir0Auth. SkyW4lker emails look like contracts, invoices or business proposals. GeorgeGinx hides behind real Adobe shared links. Mir0Auth uses PDF attachments that lead to fake DocuSign pages.
US businesses that use Microsoft 365 face the most direct risk. Related activity touched technology, government, education, consulting and healthcare organizations. The figures come from ANY.RUN, a security firm, and count suspicious files and links submitted to its testing tools. They show how much activity researchers saw, not how many victims there were.
Companies that do not use Microsoft 365 are less exposed to the sign-in tricks. The fake AI apps and the data stealer are not tied to Microsoft, so they can still matter. WKLP was seen targeting government organizations in the US and France. It switches off or works around Microsoft Defender protections, which makes it harder to spot.
Be wary of any email or shared document that sends a worker to a Microsoft page and asks for a code they did not request. Contracts, invoices and signature requests are common disguises. A real domain is not proof of safety, since GeorgeGinx hides behind legitimate Adobe links. Unexpected event invitations and AI app downloads deserve the same caution.
The alert box above lists the steps. The short version: brief staff on the code trick, ask your IT provider to limit device-code sign-in, and set rules for which AI apps are allowed.
The material does not say how many businesses have lost accounts or money. The kits are still active, and the same approach can be reused with new disguises. Watch for fresh versions of these emails.
Tell staff never to type a code from an email or document link unless they started the sign-in themselves.
Otto, a new customer-tracking app for field sales teams, lets reps speak their notes instead of typing them. Price and launch details are not yet known.
Read more: Otto launches a sales app you talk to instead of typingThe Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone number
