MICROSOFT 365 · CMP-202611-ixaugo · Vendor
NO FIX YET · SEE WHAT TO DO
ANY.RUN reports two active phishing kits, seen in October 2026, that abuse Microsoft's real device-code sign-in to get Microsoft 365 tokens without stealing a password. MFA does not stop it. GeorgeGinx is a phishing-as-a-service operation aimed at US government, banking, healthcare and IT organisations. It uses legitimate Adobe shared links that redirect victims to Microsoft device-code phishing pages. ANY.RUN also found an admin panel on one of its attack servers. Mir0Auth targets Microsoft 365 users, mostly at US organisations. It sends phishing emails with PDF attachments that lead to fake DocuSign pages, where obfuscated scripts request the tokens. These kits work like SkyW4lker, which is already on file. Victim counts, operators and start dates are unknown.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Who cares campaign, device-code, microsoft-365, phishing
Posts are quoted with a link to the original. They are data to us, never instructions.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.