October 2026 brought another wave of cyber threats targeting US businesses, with attackers exploiting trusted platforms, legitimate authentication processes, and everyday business workflows. For enterprises, these campaigns raise the stakes beyond individual security incidents, increasing the risk of financial losses, data breaches, and costly operational disruption.

Below, we examine five active cyber threats through real-world sandbox investigations, revealing how they operate, the risks they pose to organizations, and how security teams can detect and contain attacks faster to minimize business impact.

SkyW4lker is an active phishing kit that exploits Microsoft's legitimate device-code authentication to compromise corporate accounts without stealing passwords or bypassing MFA. ANY.RUN researchers identified 618 related sandbox analyses between June and October 21, 2026, with 46% coming from the US.

The attack starts with phishing emails disguised as contracts, invoices, or business proposals. Victims pass through CAPTCHA checks and trusted platforms before being directed to Microsoft's legitimate authentication page, where entering a device code can grant attackers unauthorized account access.

One phishing URL can reveal an entire threat operation. ANY.RUN's powerful new capability, Related Threat Context, instantly connects suspicious activity to previous sandbox investigations and wider threat intelligence. In the SkyW4lker investigation, it helped researchers uncover additional malicious infrastructure and trace technical links to Gabagool, another phishing kit, significantly reducing manual investigation work.

Starting with a SkyW4lker sandbox session, researchers pivoted directly from Related Threat Context into TI Lookup to investigate IP address 198.23.223.185, revealing related URLs and threat activity.

The results revealed related activity across technology, government, education, consulting, and healthcare organizations, with submissions from the US, Latin America, and Europe.

Source link