Gabagool, GeorgeGinx, Mir0Auth, SkyW4lker and WKLP were reported as active threats to US enterprises in October 2026, in a monthly roundup published by sandbox vendor ANY.RUN and based on its own malware analysis sessions. SkyW4lker, GeorgeGinx and Mir0Auth are phishing kits or phishing services that abuse Microsoft's device-code sign-in to take over corporate Microsoft 365 accounts without stealing passwords. WKLP is a Python-based infostealer and remote access trojan seen against government organizations in the US and France, and Gabagool is a separate phishing kit that researchers technically linked to SkyW4lker's infrastructure. Details in this article come from analysis published by The Hacker News.

The named sectors are government, banking, healthcare, IT, technology, education and consulting. If your firm runs Microsoft 365, three of these kits target the same sign-in process your staff use every day. That means one weakness in how your accounts handle device-code logins can be exploited by several unrelated operators at once. Tracking the families together matters for the same reason. Researchers found that SkyW4lker and Gabagool share technical links, and a single IP address (198.23.223.185) led them to related URLs and activity across multiple industries in the US, Latin America and Europe.

Some details are confirmed. ANY.RUN counted 618 SkyW4lker-related sandbox analyses between June and October 21, 2026, with 46% of them submitted from the US. The same report links 1,258 analyses to fake AI app and event-invitation campaigns, where the US ranks second worldwide. Other details are not public. The report names no threat actor behind any of the five, gives no confirmed victim counts or loss figures, and provides no prevalence numbers for Gabagool, GeorgeGinx, Mir0Auth or WKLP. Keep in mind that sandbox submissions show what analysts chose to examine, so these counts measure observed activity and do not confirm the number of breached organizations.

What Is Known About Each Tool, from Gabagool to WKLP

All five profiles come from one vendor roundup built on sandbox sessions, so the depth of detail varies widely between tools. SkyW4lker and WKLP have the most documented behavior. Gabagool is described in a single sentence.

SkyW4lker. ANY.RUN tied 618 sandbox analyses to this kit between June and October 21, 2026. Lures pose as contracts, invoices, or business proposals. Victims clear CAPTCHA checks and pass through trusted platforms before landing on Microsoft's genuine sign-in page, where entering a device code hands the attacker a working session. The chain maps to MITRE ATT&CK T1566.002 (Spearphishing Link) and T1528 (Steal Application Access Token). This is the only tool in the report with a published network indicator, the IP address 198.23.223.185. Researchers pivoted on that address to surface related URLs and activity across technology, government, education, consulting, and healthcare organizations, with submissions from the US, Latin America, and Europe. Because the final page is a real Microsoft domain, an employee who checks the address bar sees nothing unusual.

Gabagool. The source states only that researchers found technical links between Gabagool and SkyW4lker while investigating that IP address. Its delivery method, lures, targets, and indicators are not disclosed. Any further claims about Gabagool should be treated as unverified until another vendor or a government advisory publishes its own analysis.

GeorgeGinx. This operation runs as Phishing-as-a-Service (PhaaS), a model in which operators rent ready-made phishing infrastructure to other criminals. Its first hop is a legitimate Adobe Shared Link, which redirects to a device-code phishing page. Researchers examined HTML DOM changes and HTTP requests in the browser to expose the hidden destination behind the Adobe link. They also found an administration panel on an attack server, which points to a managed backend serving multiple customers. For a business, this means the starting link carries a reputable domain that email filters and staff may both trust.

WKLP. This Python-based malware executes through PowerShell (T1059.001) and a legitimate Python runtime (T1059.006). Its documented defense evasion includes:

• Adding Microsoft Defender exclusions and terminating security processes (T1562.001, Disable or Modify Tools)
• Creating firewall rules disguised to look legitimate (T1562.004, Disable or Modify System Firewall)
• Running Python activity disguised as MoUsoCoreWorker.exe, a filename used by a Windows Update component (T1036.005, Match Legitimate Name or Location)

It steals credentials, browser data, and sensitive files, and it keeps remote access to the host. An infected machine can keep running its antivirus while that antivirus is configured to ignore the malware, which extends how long data theft continues.

Mir0Auth. Delivery starts with phishing emails carrying malicious PDF attachments (T1566.001) that redirect to fake DocuSign pages. Researchers found obfuscated scripts and hidden authentication requests used to obtain Microsoft access tokens through device-code sign-in. The source reports "significant activity" against US organizations but gives no count. Stolen tokens can give attackers access to business email and stored data under the victim's identity.

What was not published. Apart from the single SkyW4lker IP address, the report contains no file hashes, domains, or URLs in its text. It links to sandbox sessions instead. No independent confirmation from government agencies or other researchers appears in the source. To track updates on these names, check CISA advisories, threat intelligence blogs from other security vendors, and the MITRE ATT&CK software catalog to see whether entries have been created for any of the five tools.

Business Exposure When Several Malware Families Are Active at Once

The October roundup describes four separate attack paths active in the same month: device-code phishing kits, trojanized AI software paired with fake event invitations, a Python infostealer that switches off endpoint protection, and phishing services that hide behind Adobe and DocuSign branding. ANY.RUN tied 1,258 sandbox analyses to the fake AI campaigns alone, with the US ranking second worldwide. For your security team, that is four sets of lures, indicators, and log sources to track at the same time.

Each path leaves evidence in a different place. Device-code abuse shows up in identity sign-in records. The infostealer shows up as Defender exclusions, terminated security processes, and firewall rules disguised to look routine. The trojanized Claude installer runs a genuine copy of the app while hidden processes copy browser session cookies, so the main trace sits in browser and software-install activity. If your team is small, time spent chasing one of these is time taken from the others. A late alert in one area can let an intrusion continue elsewhere.

The source documents how these tools behave in a sandbox. It does not document confirmed breaches at named companies, so the business impact below is conditional. If one of these tools succeeds in your environment, the harm generally falls into three categories:

• Data exposure. A stolen session token or cookie lets an attacker read mail, contracts, and shared files with the victim's own permissions, and stolen cookies can avoid a fresh MFA prompt. The infostealer is documented as taking credentials, browser data, and sensitive files.
• Operational disruption. A host where security tools have been disabled cannot be trusted until it is rebuilt. Reimaging machines and resetting accounts takes staff offline and pulls IT away from planned work.
• Incident-response costs. Forensic investigation, outside counsel, and notification logistics add expense even when no data leaves the network, because you have to establish what the attacker could reach.

The legal side applies only if an infection leads to unauthorized access to protected data. If your company is publicly traded, the SEC's cyber incident disclosure rules require you to disclose a cybersecurity incident on a short, fixed timeline once you determine it is material. If you are a healthcare provider, health plan, or business associate, HIPAA requires notice to affected individuals and to HHS when unsecured protected health information is involved. Healthcare and government both appear in the sectors where researchers saw related activity, alongside technology, education, and consulting.

One mailbox takeover can reach several of these obligations at once. A compromised account belonging to someone in finance or patient services may hold data covered by multiple state laws and a federal rule simultaneously, and your counsel will need to sort out which apply before any deadline passes.

Leadership does not need to evaluate the tools directly. Three questions to put to your security team will show where coverage is thin:

• If someone approved a device-code sign-in for an attacker last month, how would we know, and how quickly?
• Could we tell if an employee installed an AI tool that quietly copied their browser sessions?
• Who decides whether an incident triggers state, SEC, or HIPAA notification, and has that decision process been tested?

The answers will show which of the four attack paths your team can see clearly and which ones rely on luck to catch.

Detection and Response Steps for Gabagool, Mir0Auth and the Other Reported Tools

Three of the five reported tools (SkyW4lker, GeorgeGinx and Mir0Auth) abuse the same Microsoft device-code sign-in flow, so the most useful first step is to review your Microsoft Entra sign-in logs for device-code authentication events. The steps below use the NIST Cybersecurity Framework and are grouped by urgency, and each one names the system to check and the output it should produce.

Immediate (24 to 48 hours): Identify and Detect

• Query Entra sign-in logs for device-code authentications across recent months. Most office staff never use this flow, so any hit on a regular user account needs review. Revoke active sessions for confirmed cases, because a stolen token keeps working after the user changes their password.
• Search your EDR, SIEM and threat intel platform for any detection or signature that references Gabagool, GeorgeGinx, Mir0Auth, SkyW4lker or WKLP. Include the SkyW4lker-linked IP address 198.23.223.185 in firewall, proxy and DNS log searches.
• Confirm signature and feed currency. Check that endpoint protection definitions and threat intel feeds updated within the last day. Confirm that Microsoft Defender Tamper Protection is enabled on every endpoint, since WKLP adds Defender exclusions and terminates security processes.
• Ask your EDR and email security vendors in writing whether they have detection coverage for each of the five names. Record the answers per family. Public detail on Gabagool is limited, so ask about it by name.

Short term (1 to 2 weeks): Protect and Respond

Your identity administrator should create an Entra Conditional Access policy that limits device-code authentication to the specific users and devices that need it. The source names this as the main control against device-code phishing. Without that policy, a single phishing email can hand an attacker a working session to mailboxes and shared files.

• Have the SOC lead add all five names to threat-hunting watchlists, along with Adobe shared links and DocuSign-branded pages that redirect to Microsoft sign-in prompts.
• Set up alerts for vendor and CISA publications so new IOCs for these tools reach your analysts the day they appear.
• Publish an approved list of AI applications and block unauthorized installs through endpoint management. Tell staff to confirm unexpected event invitations with the sender through a separate channel.
• Review your incident response playbook for a multi-family event. It should assign separate owners for identity containment (token and session revocation), endpoint isolation, and mail purging, so one team is not working all three at once.

Longer term: Detect and Recover

Tune detection rules around the behaviors the source documents. Name-based signatures only match known samples, and behavior rules also cover new variants of the same tools. Alert on:

• New Microsoft Defender exclusions, stopped security processes, and firewall rules created outside your change process
• PowerShell launching a Python runtime, or Python code running under system-looking names such as MoUsoCoreWorker.exe
• Non-browser processes reading browser cookie stores, which is how the trojanized Claude installer collected session cookies
• Unusual outbound connections from workstations to IP addresses with no business history

Your email gateway should inspect where document-sharing links actually lead. Many gateways approve these links because of the sender domain alone, and both GeorgeGinx and Mir0Auth rely on that trust.

Test restoration of file servers and mailbox data from backup, and record how long each restore takes. WKLP steals files and keeps remote access, so recovery from that malware also requires rebuilding affected hosts from a known-clean point and rotating every credential stored on those machines. Write the restore times and rebuild steps into the playbook so the next team that responds to this threat has them on hand.

Priorities for Security Teams Tracking These Five Threats

Five tools (Gabagool, GeorgeGinx, Mir0Auth, SkyW4lker and WKLP) appear in ANY.RUN's October 2026 roundup as risks to US enterprises, and the public record on them is still thin. The roundup is a contributed partner piece. It names no threat actor behind any of the tools, and the only network indicator printed in its text is the IP address 198.23.223.185, tied to SkyW4lker.

File hashes, domain lists and wider infrastructure details sit inside ANY.RUN's sandbox sessions and lookup service. Your team may not have them unless your vendors have already pulled them in. Your existing tools can only flag these kits and the infostealer if their vendors have built detections from that material, and a product name alone does not tell you whether they have.

The most important step is to ask your EDR and threat intelligence vendors today, in writing, whether they detect Gabagool, GeorgeGinx, Mir0Auth, SkyW4lker and WKLP, and which indicators support that coverage. Alongside those requests, run a retrospective search of your logs for each of the five names, the SkyW4lker IP above, and any indicators the vendors send back. That search shows whether any related activity reached your environment before you had their answers.

If the vendor replies are vague, or your log retention does not reach far enough back to answer the question, a security assessment scoped to these five tools can establish what your current coverage actually detects.