---
id: "CMP-202611-ixaugo"
kind: "campaign"
aliases: []
title: "GeorgeGinx and Mir0Auth phishing kits take over Microsoft 365 accounts through device-code sign-in, hidden behind Adobe shared links and fake DocuSign pages (ANY.RUN)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Microsoft 365", "fixed": [], "affected": "accounts where the OAuth device code flow is allowed", "ecosystem": "vendor"}, {"name": "Microsoft Entra ID", "fixed": [], "affected": "tenants that do not block the device code flow", "ecosystem": "vendor"}]
ecosystems: []
tags: ["campaign", "device-code", "early-warning", "microsoft-365", "phishing"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-05T10:32:36+00:00"
updated_at: "2026-11-05T10:33:09+00:00"
sources: [{"source": "analyst", "url": "https://thehackernews.com/2026/11/5-active-cyber-threats-that-put-us.html", "first_seen_at": "2026-11-05T10:32:36+00:00", "cites": ["https://thehackernews.com/2026/11/5-active-cyber-threats-that-put-us.html"]}]
exploit_sources: []
---

# GeorgeGinx and Mir0Auth phishing kits take over Microsoft 365 accounts through device-code sign-in, hidden behind Adobe shared links and fake DocuSign pages (ANY.RUN)

ANY.RUN reports two active phishing kits, seen in October 2026, that abuse Microsoft's real device-code sign-in to get Microsoft 365 tokens without stealing a password. MFA does not stop it. GeorgeGinx is a phishing-as-a-service operation aimed at US government, banking, healthcare and IT organisations. It uses legitimate Adobe shared links that redirect victims to Microsoft device-code phishing pages. ANY.RUN also found an admin panel on one of its attack servers. Mir0Auth targets Microsoft 365 users, mostly at US organisations. It sends phishing emails with PDF attachments that lead to fake DocuSign pages, where obfuscated scripts request the tokens. These kits work like SkyW4lker, which is already on file. Victim counts, operators and start dates are unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft 365 affected accounts where the OAuth device code flow is allowed fixed no fixed version listed
- vendor:Microsoft Entra ID affected tenants that do not block the device code flow fixed no fixed version listed

## How to check

- In Entra ID sign-in logs, look for sign-ins with authentication protocol 'deviceCode' that the user did not expect, especially right after they opened an Adobe shared link or a DocuSign-style PDF.
- In mail, look for emails with an Adobe shared document link (GeorgeGinx), or with a PDF attachment that leads to a DocuSign-looking page not on docusign.com/docusign.net (Mir0Auth).
- A page that asks the user to type a code at microsoft.com/devicelogin after they opened a shared document is this attack.
- The sources give no domains or IPs for these two kits (unknown).

## Fix

- Block the device code flow with an Entra ID Conditional Access authentication-flows policy, except for named accounts that need it.
- If a suspicious device-code sign-in is found, revoke the user's sessions and refresh tokens, and check mailbox rules, OAuth app consents and what was accessed.
- Tell staff that no real Adobe or DocuSign document ever asks them to enter a code on a Microsoft page.

## Timeline

- 2026-11-05T10:32:36+00:00 analyst https://thehackernews.com/2026/11/5-active-cyber-threats-that-put-us.html

## Documents

- [describes] @TheHackersNews: 🚨 Five cyber threats targeting US businesses.

Microsoft 365 device-code phishin https://x.com/TheHackersNews/status/2118284028080243165
- [describes] 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 (ANY.RUN via The Hacker News) https://thehackernews.com/2026/11/5-active-cyber-threats-that-put-us.html

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_