{"id":"CMP-202611-ixaugo","kind":"campaign","aliases":[],"related":[],"title":"GeorgeGinx and Mir0Auth phishing kits take over Microsoft 365 accounts through device-code sign-in, hidden behind Adobe shared links and fake DocuSign pages (ANY.RUN)","description":null,"summary":"ANY.RUN reports two active phishing kits, seen in October 2026, that abuse Microsoft's real device-code sign-in to get Microsoft 365 tokens without stealing a password. MFA does not stop it. GeorgeGinx is a phishing-as-a-service operation aimed at US government, banking, healthcare and IT organisations. It uses legitimate Adobe shared links that redirect victims to Microsoft device-code phishing pages. ANY.RUN also found an admin panel on one of its attack servers. Mir0Auth targets Microsoft 365 users, mostly at US organisations. It sends phishing emails with PDF attachments that lead to fake DocuSign pages, where obfuscated scripts request the tokens. These kits work like SkyW4lker, which is already on file. Victim counts, operators and start dates are unknown.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-05T10:32:36+00:00","products":[{"name":"Microsoft 365","fixed":[],"affected":"accounts where the OAuth device code flow is allowed","ecosystem":"vendor"},{"name":"Microsoft Entra ID","fixed":[],"affected":"tenants that do not block the device code flow","ecosystem":"vendor"}],"ecosystems":[],"tags":["campaign","device-code","early-warning","microsoft-365","phishing"],"not_affected_if":[],"how_to_check":"- In Entra ID sign-in logs, look for sign-ins with authentication protocol 'deviceCode' that the user did not expect, especially right after they opened an Adobe shared link or a DocuSign-style PDF.\n- In mail, look for emails with an Adobe shared document link (GeorgeGinx), or with a PDF attachment that leads to a DocuSign-looking page not on docusign.com/docusign.net (Mir0Auth).\n- A page that asks the user to type a code at microsoft.com/devicelogin after they opened a shared document is this attack.\n- The sources give no domains or IPs for these two kits (unknown).","fix":"- Block the device code flow with an Entra ID Conditional Access authentication-flows policy, except for named accounts that need it.\n- If a suspicious device-code sign-in is found, revoke the user's sessions and refresh tokens, and check mailbox rules, OAuth app consents and what was accessed.\n- Tell staff that no real Adobe or DocuSign document ever asks them to enter a code on a Microsoft page.","status":"open","published_at":null,"first_seen_at":"2026-11-05T10:32:36+00:00","triaged_at":"2026-11-05T10:32:36+00:00","updated_at":"2026-11-05T10:33:09+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':29A '-365':46B '2026':57B '365':9A,34A,72B,132B 'abus':59B 'account':10A 'activ':51B 'admin':121B 'adob':20A,104B 'aim':92B 'alreadi':164B 'also':118B 'any.run':27A,48B,117B 'attach':144B 'attack':127B 'bank':96B 'behind':19A 'campaign':38B 'cmp':28A 'code':14A,41B,65B,114B 'count':168B 'date':172B 'devic':13A,40B,64B,113B 'device-cod':12A,39B,63B,112B 'docusign':25A,149B 'earli':43B 'early-warn':42B 'email':141B 'entra':36A 'fake':24A,148B 'file':166B 'found':119B 'georgeginx':1A,31A,83B 'get':70B 'govern':95B 'healthcar':97B 'hidden':18A 'id':37A 'ixaugo':30A 'kit':5A,53B,158B 'lead':146B 'legitim':103B 'like':160B 'link':22A,106B 'mfa':78B 'microsoft':8A,33A,35A,45B,60B,71B,111B,131B 'mir0auth':3A,32A,129B 'most':134B 'obfusc':152B 'octob':56B 'one':124B 'oper':91B,169B 'organis':100B,137B 'page':26A,116B,150B 'panel':122B 'password':77B 'pdf':143B 'phish':4A,47B,52B,87B,115B,140B 'phishing-as-a-servic':86B 'real':62B 'redirect':108B 'report':49B 'request':154B 'script':153B 'seen':54B 'send':139B 'server':128B 'servic':90B 'share':21A,105B 'sign':16A,67B 'sign-in':15A,66B 'skyw4lker':161B 'start':171B 'steal':75B 'stop':81B 'take':6A 'target':130B 'token':73B,156B 'two':50B 'unknown':174B 'us':94B,136B 'use':102B 'user':133B 'victim':109B,167B 'warn':44B 'without':74B 'work':159B","nicknames":["GeorgeGinx","Mir0Auth"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["365","entraid","georgeginx","microsoft365","microsoftentraid","mir0auth"],"ptokens":["365","entra","id","microsoft"],"labels":["campaign","devicecode","earlywarning","high","microsoft365","phishing","vendor"],"campaign_type":"phishing","first_public_at":"2026-11-05T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-ixaugo","url":"https://thehackernews.com/2026/11/5-active-cyber-threats-that-put-us.html","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-05T10:32:36+00:00","fetched_at":"2026-11-05T10:32:36+00:00","note":null,"cites":["https://thehackernews.com/2026/11/5-active-cyber-threats-that-put-us.html"]}],"documents":[{"id":75201,"url":"https://x.com/TheHackersNews/status/2118284028080243165","title":"@TheHackersNews: 🚨 Five cyber threats targeting US businesses.\n\nMicrosoft 365 device-code phishin","kind":"post","source":"x","publisher":null,"text":"🚨 Five cyber threats targeting US businesses.\n\nMicrosoft 365 device-code phishing, fake AI apps stealing credentials, and malware disabling Microsoft Defender.\n\nInside the SkyW4lker, Mir0Auth, GeorgeGinx, and WKLP campaigns.\n\nSee how the attacks work and what to watch for ↓ https://t.co/Kq7nlASvPD\n\nlikes 12 reposts 3","published_at":"2026-11-05T10:07:22+00:00","relation":"describes","confidence":null,"note":null},{"id":75216,"url":"https://thehackernews.com/2026/11/5-active-cyber-threats-that-put-us.html","title":"5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 (ANY.RUN via The Hacker News)","kind":"blog","source":"analyst","publisher":null,"text":"ANY.RUN roundup. GeorgeGinx: active PhaaS targeting US government, banking, healthcare, IT; legitimate Adobe Shared Links redirect victims to Microsoft Device Code phishing pages; admin panel found on attack server. Mir0Auth: phishing kit targeting Microsoft 365 users, mainly US; phishing emails with malicious PDF attachments redirect to fake DocuSign pages; obfuscated scripts and hidden auth requests obtain M365 tokens via Device Code authentication. SkyW4lker: 618 sandbox analyses June to 21 Oct 2026, 46% US; contract/invoice/proposal lures, CAPTCHA, trusted platforms, then real Microsoft device-code page; related IP 198.23.223.185; links to Gabagool kit. WKLP: Python infostealer/RAT targeting government in US and France, adds Defender exclusions, disguised as MoUsoCoreWorker.exe. Mitigation: restrict device-code flow via Entra Conditional Access.","published_at":"2026-11-05T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}