US businesses faced another wave of sophisticated cyberattacks in October 2026, as cybercriminals increasingly exploited trusted online platforms, legitimate authentication systems and routine business activities to compromise corporate networks and steal sensitive information.
The campaigns demonstrate how attackers are moving beyond traditional malware distribution and password theft, adopting more sophisticated techniques capable of bypassing conventional security measures.
According to cybersecurity investigations conducted by ANY.RUN researchers, five major cyber threats pose significant risks to American enterprises, exposing organisations to financial losses, data breaches, account takeovers and operational disruptions.
The findings highlight the growing challenges facing corporate security teams as attackers exploit the increasing adoption of artificial intelligence, cloud services and digital authentication technologies.
1. SkyW4lker Phishing Campaign Targets Microsoft 365 Accounts
One of the major threats identified is SkyW4lker, an active phishing kit designed to compromise Microsoft 365 accounts by exploiting Microsoft’s legitimate device-code authentication process.
Unlike conventional phishing attacks that attempt to steal passwords or bypass multi-factor authentication (MFA), SkyW4lker abuses the authentication process to gain unauthorised access to corporate accounts.
ANY.RUN researchers identified 618 related sandbox investigations between June and October 21, 2026, with approximately 46 per cent originating from the United States.
The campaign typically begins with fraudulent emails disguised as business contracts, invoices or commercial proposals. Victims are directed through CAPTCHA verification pages and seemingly legitimate online platforms before being redirected to Microsoft’s authentication page.
Attackers then persuade victims to enter a supplied device code, unknowingly authorising access to their accounts.
Once authentication is completed, cybercriminals can obtain access without necessarily stealing the victim’s password or triggering another MFA verification.
How Researchers Traced the SkyW4lker Campaign
During their investigation, researchers used ANY.RUN’s Related Threat Context capability to connect suspicious URLs with previously identified malicious infrastructure and related cybercrime activities.
The investigation also uncovered technical connections between SkyW4lker and another phishing operation known as Gabagool.
By examining a suspicious IP address, 198.23.223.185, researchers identified additional malicious URLs and related activities across technology, government, education, consulting and healthcare organisations.
The findings demonstrated how security analysts can use connected threat intelligence to identify wider attack infrastructure rather than investigating individual suspicious links in isolation.
To reduce exposure, organisations are advised to restrict unnecessary device-code authentication through Microsoft Entra Conditional Access and investigate suspicious authentication activities beyond initial security alerts.
2. Fake AI Campaigns Target Businesses With Credential Theft
Cybercriminals are increasingly exploiting the popularity of artificial intelligence by creating fraudulent applications and event invitations impersonating popular AI platforms, including ChatGPT and Claude.
ANY.RUN researchers linked 1,258 sandbox investigations to fake AI-related campaigns, with the United States ranking as the second-largest source of submissions worldwide.
The attackers use deceptive software downloads and fraudulent event invitations to distribute malware, steal login credentials and compromise corporate accounts.
Some campaigns are designed to obtain access to Microsoft 365 and Google accounts, potentially exposing business communications, confidential documents and other sensitive organisational information.
One particularly deceptive incident involved a genuine Claude installer that appeared to function normally while hidden malicious processes operated in the background.
During installation, the malicious activity reportedly targeted browser session cookies, which could allow attackers to hijack authenticated business accounts without requiring victims to complete another multi-factor authentication challenge.
This technique presents a serious security concern because employees may believe they are downloading legitimate AI software while malicious processes secretly compromise their devices.
The increasing use of AI tools in workplaces also creates opportunities for cybercriminals to exploit employees’ familiarity with popular platforms.
Organisations are therefore advised to download AI applications only from verified sources, monitor suspicious browser activity and strengthen endpoint security measures.
Growing Security Concerns for American Enterprises
The two campaigns highlight the changing nature of cyber threats confronting businesses, particularly as attackers increasingly abuse legitimate services and trusted authentication mechanisms.
SkyW4lker demonstrates how phishing operations can exploit legitimate authentication processes, while fake AI campaigns show how the growing adoption of artificial intelligence can be used to deceive employees and compromise corporate systems.
For security operations centres, the findings reinforce the importance of monitoring unusual authentication requests, investigating suspicious software installations and connecting individual security alerts with broader threat intelligence.
The investigations also demonstrate the value of sandbox analysis in identifying malicious behaviour that might otherwise remain undetected by traditional security tools.
As cybercriminals continue refining their techniques, organisations are being urged to strengthen their security infrastructure, educate employees about emerging phishing methods and adopt proactive threat detection systems to reduce the impact of attacks.