🐟 Phishing activity in the past 7 days.
Track latest phishing threats in TI Lookup, now available for free.

👨‍💻 TI Lookup gives your SOC/DFIR instant access to live threat data and real-world attack context, helping optimize detection and response.

95% of teams already speed up investigations.
🔍 Start for free.

🚀 #ANYRUN's TI Feeds now integrate with IBM QRadar SIEM.

Cut MTTR/D, boost KPIs & optimize SOC ROI.

👉 Achieve stronger security and business results now.

Evasive malware tactics bypass traditional defenses 🚨

Join our technical webinar where our experts will walk through real-world cases and share practical detection tips.
 
📅 September 17 | Live session + Q&A
👉 Register and bring your team

🚨 From fake interviews to hijacked open source packages, Lazarus Group escalated its operations in 2025

Discover all active campaigns and malware of this APT and get actionable advice for your SOC to be ready for the next attack. Read now.

🚨 Fileinfectors Evolved: Spreading Ransomware Across Enterprise Networks
⚠️ Fileinfector malware inserts its code into files. These threats once spread mainly through external drives and local systems. Today’s file infectors are mostly hybrid variants, frequently combined with ransomware.

These variants encrypt data and inject malicious code into files, enabling further spread when infected files are executed.

❗️ They are especially dangerous in corporate environments with shared folders, where a single infected file can rapidly spread across the network and cause widespread damage.
Such outbreaks overwhelm security teams, complicate incident response, and disrupt business continuity.

👨‍💻 An optimized SOC that relies on early detection, behavioral analysis, and proactive hunting is critical to limiting impact. Let’s see malware execution on a live system.
👉 See analysis.

In this case, the malware is interacting with multiple files and modifying their content. The infected files became executables, with PE headers confirming injected malicious code.
The analysis revealed hybrid behavior: a fileinfector acting like ransomware, enabling further spread on execution.

🔍 Use this TI Lookup search query to explore fileinfector activity and enrich IOCs with actionable threat context.
👾 Gather malware hashes and infected files to power proactive hunting.

Hybrid fileinfectors pose a significant threat to enterprise networks. Leveraging #ANYRUN Sandbox and TI Lookup reduces MTTR by up to 21 minutes per case and gives access to 24x more IOCs from millions of past analyses.

Strengthen resilience and protect critical assets through proactive security with #ANYRUN 🚀 #ExploreWithANYRUN

👾 73% of attacks start with phishing, yet SOC teams often miss early signs. IOC enrichment helps detect them earlier and refine detection rules.

👉 See how context-rich data strengthens proactive defense.

Top 10 last week's threats by uploads 🌐

⬆️ #Lumma 969 (726)
⬆️ #Quasar 399 (381)
⬆️ #Amadey 382 (192)
⬆️ #Redline 376 (179)
⬆️ #Vidar 365 (275)
⬇️ #Agenttesla 291 (336)
⬆️ #Remcos 274 (262)
⬇️ #Xworm 261 (515)
⬆️ #Dcrat 245 (209)
⬆️ #Stealc 233 (224)

👉 Track them all.
#Top10Malware

🚨 BTMOB RAT is rewriting mobile cybersecurity rules in 2025!

This $5K Android malware weaponizes accessibility features for live screen control, banking overlay attacks, and crypto theft.

👉 Learn its spread, impact & defense.

🐟 Phishing activity in the past 7 days.
Track latest phishing threats in TI Lookup, now available for free.

🚀 #ANYRUN now integrates with Cortex XSOAR from Palo Alto Networks.

Solve alert fatigue, missed incidents, and slow response with automated sandbox analysis and fresh threat intelligence.

👉 Simplify workflows, boost defense.

🚨 Malicious SVG Leads to Microsoft-Themed PhishKit.
We observed a phishing campaign that began with testing activity on September 10 and scaled into full spam activity by September 15.

⚠️ A legitimate domain was abused to host a malicious SVG disguised as a PDF. Attackers hide redirects and scripts inside images to bypass controls and social-engineer users into phishing flows.

🎯 This case shows a structured infrastructure similar to a PhaaS framework, showing how attackers rely on robust, scalable models for mass credential harvesting, now a standard across the phishing ecosystem.

For enterprises, the risks are blind spots in monitoring, delayed detection and response, and an increased risk of credential theft or data breach.

👨‍💻 When opened in a browser, the SVG displays a fake “protected document” message and redirects the user through several phish domains. The chain includes Microsoft-themed lures such as:
🔹 loginmicrosft365[.]powerappsportals[.]com
🔹 loginmicr0sft0nlineofy[.]52632651246148569845521065[.]cc

❗️ The final phishing page mimics a Microsoft login and uses a Cloudflare Turnstile widget to appear legitimate.

Unlike standard image formats, SVG is an XML-based document that can embed malicious JavaScript or hidden links. Here, the redirect was triggered by a script acting as an XOR decoder, which rebuilt and executed the redirect code via eval.

🎯 For SOC analysts, being able to trace every redirect step and uncover hidden payloads is critical to investigating phishing campaigns. See execution on a live system and collect IOCs.

For CISOs, the critical takeaway is that attackers exploit trusted platforms and brand impersonation to bypass defenses, directly threatening business resilience and user trust.

🔍 Use these TI Lookup search queries to expand visibility and enrich #IOCs with actionable threat context.
Suspicious SVG downloads:
🔹 commandLine:"Downloads\\*.svg"
Microsoft-themed phishing domains:
🔹 domainName:"microsoft.*.*"
🔹 domainName:"^loginmicr?sft*.cc$"

IOCs:
Revised _payment_and_Benefitschart.pdf______-.svg
A7184bef39523bef32683ef7af440a5b2235e83e7fb83c6b7ee5f08286731892

Strengthen resilience and protect critical assets through proactive security with #ANYRUN 🚀 #ExploreWithANYRUN

⌛ Cutting response times is not rocket science.

It requires clear steps that every SOC can take to achieve faster MTTR.

👉 See how your team can become more efficient.

🔍 Can your team spot evasive attacks in real time?
See phishing kits, ClickFix & LotL cases broken down by #ANYRUN experts.

🚨 Only 3 hours left!
Learn how to expand visibility, reduce workload, and improve detection & response.

👉 Save your spot.

❓Is your SOC still reacting to threats instead of anticipating them?

With #ANYRUN’s TI Lookup and TI Feeds, your team gains fast, reliable intelligence to act proactively, cut response time, and reduce blind spots.

👉 Read our guide for CISOs.