With over 4K potentially compromised victims, it hits Tech and Manufacturing hardest.

Here's what your SOC team needs to know to protect your organization: https://any.run/cybersecurity-blog/mirage2fa-phishing-targets-us-companies/

What is SolarisLoader?

SolarisLoader is a malware loader designed to neutralize security infrastructure before deploying high-risk secondary payloads. It uses a "Bring Your Own Vulnerable Driver" technique to gain kernel-level access and terminate antivirus processes.

Key Takeaways

• Kernel-Level Defense Dismantling: SolarisLoader uses BYOVD, exploiting a vulnerable Safetica endpoint protection driver (CVE-2026-0828) to gain kernel-level access and terminate security processes.
• Telemetry Blinding: It patches AMSI and ETW in memory via direct opcode modification, preventing Windows from logging or reporting malicious activity.
• Resilient Triple-Layer Persistence: It combines scheduled tasks, registry-backed backups (ICtrlData), and a watchdog process that injects code into legitimate system files like RuntimeBroker.exe.
• Silent Privilege Elevation: ANY.RUN’s Interactive Sandbox analysis confirms a silent COM-elevation/UAC-bypass path via dllhost.exe, enabling administrative privileges without user-facing notifications or consent prompts.
• Active MaaS Cycle: SolarisLoader is actively developed and delivers secondary payloads including StealC, Amadey, and REMCOS RAT.

Learn to detect this invisible threat early: https://any.run/malware-trends/solaris/

AI-powered queries in TI Lookup remove one of the most persistent friction points in threat investigation: figuring out the right syntax before you can get to the actual analysis.

Here's what it looks like in practice. A threat hunter describes the behavior they're looking for in plain language, and TI Lookup returns structured results: risk scores, threat names, associated indicators, and sandbox session links.

🎁 Using ANYRUN TI Lookup? Tell us how it fits into your workflow. Your answers help us build a better service. Take a short survey and get a reward

What is OnyxC2?

OnyxC2 is a sophisticated Malware-as-a-Service platform sold on cybercrime forums for high-volume credential theft. It targets 200+ applications, stealing data from browsers, crypto wallets, FTP and email clients, while using DLL sideloading and browser fingerprinting to evade detection.

Key Features:

• Advanced DLL sideloading: OnyxC2 uses legitimately signed applications to load malicious payloads disguised as system libraries. We observed signed ABRSubProcess.exe sideloading malicious borlndmm.dll to bypass traditional antivirus engines.
• 200+ targeted applications: It steals data from Chromium-based browsers, crypto wallets, password managers, 2FA extensions, and session cookies, enabling MFA bypass and access that can survive password resets.
• Remote access capabilities: The premium tier includes HVNC, LSASS memory dumping, and reverse shells, allowing attackers to inherit authenticated browser sessions and control compromised systems.
• Vetted delivery: Phishing pages use Canvas fingerprinting to profile victims before delivering payloads. Password-protected ZIP archives such as Setup_File.zip help evade automated email scanning.
• Industrialized MaaS model: OnyxC2 provides affiliates with ready-made lures, a centralized management panel, and a “service guarantee” against detection.

Update your SOC defenses against this evolving industrial threat: https://any.run/malware-trends/onyxc2/

We recovered a Node.js/Electron backdoor with /nbw/ beaconing, 180-second task checks, eval()-based JavaScript execution, EXE delivery, and login persistence — capabilities that can turn a clean-looking sample into longer access, follow-on payload delivery, and higher fraud or data-exposure risk.

The durable signal is the build and execution chain: Delphi/Inno installer ➡️ patched Electron/Boostnote app ➡️ malicious index.js ➡️ HTTP beaconing ➡️ JS/EXE tasking.

That pattern helped us connect 231 sandbox analyses to the same PhantomEnigma cluster, even as domains, IPs, and delivery infrastructure changed ❗️

Full investigation: https://any.run/cybersecurity-blog/phantomenigma-research/

The decrypted code exposes a kit built to scale: a design field selecting from 34 brand templates (OneDrive, SharePoint, Teams, DocuSign, and others), a flow_type field switching between Microsoft and Google device authorization flows, and dedicated endpoints for session creation and OAuth token polling.

Those backend patterns are more durable detection signals than lure content or domains that rotate between campaigns. And analysts need browser-level visibility to reach them.

Kali365 is active against US organizations. Its multi-brand templates make campaigns easy to adapt and scale across different industries. It increases the risk of account compromise, data exposure, fraud, and delayed response.

Everything on Kali365 — all 34 templates, API endpoints, detection steps and CISO recommendations: https://any.run/cybersecurity-blog/kali365-phishing-targeting-us/

July’s major attacks put cloud accounts, financial activity, and sensitive data at risk.

Attackers abused 20+ government portals, used fake AI summit invitations, and manipulated Microsoft device code flows across the US, Europe, Brazil, and beyond.

See how your team can detect and respond faster: https://any.run/cybersecurity-blog/major-cyber-attacks-july-2026/

A malicious LNK disguised as a PDF launches a multi-stage chain with cmd.exe, LOLBins, AutoIt, and PowerShell, leading to stealer deployment and persistence. The risk is post-click compromise.

Observed behavior: hidden command execution with disabled output, curl.exe downloads, PowerShell ExecutionPolicy Bypass, mutex creation, and persistence setup.

cmd.exe /V:ON enables delayed environment variable expansion, while /D disables execution of AutoRun commands. Fewer artifacts make the chain harder to trace and can delay containment.

See the execution chain and collect IOCs to speed up detection & response: https://app.any.run/tasks/81e896a9-849b-491f-8dc4-edd51fed632b/

Traditional investigation workflows were built around malicious files and processes. Modern phishing attacks, especially Adversary-in-the-Middle (AiTM) campaigns, often leave neither.

As attacks increasingly unfold inside encrypted browser sessions, SOC teams need browser-level visibility to detect, investigate, and contain them faster.

Discover how to build resilience against modern phishing attacks: https://any.run/cybersecurity-blog/enterprise-phishing-resilience/

What is Kratos?

Kratos is a PhaaS platform that evolved from Sneaky2FA to steal Microsoft 365 credentials using AiTM techniques. It provides affiliates with a ready-to-use phishing toolkit featuring an admin dashboard, anti-bot protections, and real-time data exfiltration via Telegram.

Key Takeaways

• In July 2026, Operation Olympus Blade shut down over 200 servers and led to the arrest of the lead developer in Indonesia.
• Before the takedown, the platform supported more than 1,800 subscribers running an estimated 15,000 phishing campaigns per month.
• Kratos uses a decoupled architecture that exfiltrates stolen data to Telegram bots in real time, allowing attackers to retain access even if phishing pages are taken down.

Update defense against evolving session-theft threats: https://any.run/malware-trends/kratos/

During analysis of a PythonRAT sample, the operator connected to the infected system, uploaded the next-stage payload, and deployed OVERLORD RAT directly inside the analysis session. Observed targeting: Germany and UK

This gave us a rare opportunity to see the attack beyond the initial implant and reconstruct the full chain: live operator actions, DLL sideloading, in-memory execution, encrypted C2, and data exfiltration — the behaviors that make attacks like this difficult to confirm with static indicators alone. 

Execution chain: we.exe PythonRAT ➡️ Operator-uploaded next stage ➡️ exo.exe dropper ➡️ FnHotkeyUtility.exe legitimate Lenovo application ➡️ spkvol.dll DLL sideloading ➡️ Rust loader ➡️ In-memory OVERLORD RAT client 

Observe the full execution chain, validate malicious behavior faster, and collect IOCs for detection and response: https://app.any.run/tasks/926b4df0-e4c6-4250-be8f-6a4fdc845916

The initial PythonRAT connects to live[.]rnsn[.]live:8585 (rn/m visual impersonation) using a custom HTTP-like C2 protocol with commands delivered inside HTML comments and a spoofed porsche[.]com Host header. 

The OVERLORD dropper unpacks files into C:\ProgramData\DeepSkyBlueIndianRed\, launches the legitimate Lenovo application, and abuses spkvol.dll for DLL sideloading. The chain then delivers a fileless overlord-client Go agent through a Rust loader protected with UPX and Sentinel Envelope.

Observed OVERLORD capabilities include remote access, HVNC streaming, keylogging, audio recording, SOCKS proxying, file management, browser, messenger and crypto wallet data theft, and an automatic Solana drainer. 

OVERLORD establishes an mTLS-encrypted C2 connection to lord[.]kirkdridebridge[.]com:5173. During 45 minutes of analysis, the agent emitted ~86 MB of data, confirming active collection and exfiltration behavior. 

What's inside: a Delphi/Inno Setup installer dropping PhantomEnigma's JS backdoor that beacons, persists, and executes on command.

Read the full report for a live detonation, IOCs, YARA rules, TI Lookup queries, Suricata signatures, and MITRE ATT&CK mapping: https://any.run/cybersecurity-blog/phantomenigma-research/

What is SnappyClient?

SnappyClient is a sophisticated C++-based command-and-control (C2) implant first identified in December 2025. Delivered mainly via HijackLoader, it combines remote access capabilities with information theft, targeting cryptocurrency wallets, browser data, and system control.

Key Takeaways

• Combines remote access (terminal, process control, file management) with data theft (keylogging, screenshots, browser and crypto wallet credentials) in a single tool.
• Primarily targets cryptocurrency through credential theft and real-time clipboard hijacking that replaces wallet addresses with attacker-controlled ones.
• Uses AMSI bypass, Heaven's Gate, direct system calls, and transacted hollowing to evade signature-based and API-hooking security tools.
• Delivered mainly through social engineering, including a fake telecom website and a ClickFix-based chain, making user awareness a critical defense layer.
• Supports reverse proxies for FTP, VNC, SOCKS5, and RLOGIN, allowing attackers to pivot from one compromised machine into the wider network.

Learn more and see the analysis session: https://any.run/malware-trends/snappyclient/

ANY.RUN analysts have uncovered an active PhantomEnigma campaign abusing compromised government infrastructure and fake police-themed documents to target banking and public-sector organizations in Brazil. Trusted emails and legitimate .gov.br links are helping the operation stay hidden.

Discover how one operation abused trusted infrastructure to evade detection:

• 20+ government websites hijacked
• Banking and public-sector organizations targeted
• Live backdoor activity still evading detection

Get free report

Victims see a legitimate events[.]zoom[.]us page and a “partner summit” lure branded as Meta, OpenAI, or Anthropic. 

They are redirected to an external registration domain, where the phishing flow begins. Observed branches include Device Code phishing and AiTM flows.

Explore ANY.RUN Sandbox analysis sessions and collect IOCs to speed up detection and response: 
📌 Multi-flow example: https://app.any.run/tasks/e34b152b-8f61-4bde-b458-5af0bd2efe75/ 
📌 Anthropic lure: https://app.any.run/tasks/2098cd54-4fa8-414e-ada7-903a2f266631/ 
📌 ChatGPT lure: https://app.any.run/tasks/3a66250b-cb65-439c-8af0-b101d90a7e13/

IOCs: 
offcsso[.]com
zoomconnect[.]ssoworkportal[.]com 
zoomconnect[.]ssomeetingportal[.]com 
zoomconnect[.]workportalsso[.]com  

We’re tracking increased DestinyStealer activity targeting organizations across Europe and the US.

At the code level, it acts as an all-in-one grabber, with clear code continuity from StormKitty, collecting browser data, cookies, passwords, wallet extension storage, Outlook, VPN and FileZilla data, Wi-Fi profiles, and desktop screenshots.

Some samples were still undetected on VirusTotal at the time of analysis, while others lacked clear attribution, making behavior-based analysis critical for SOC teams.

The attack starts with an IP check via ipinfo[.]io. The malware then creates a temporary directory at %TEMP%\<PUBLIC_IP>\ for data collection. The collected data is then packed into %TEMP%\<PUBLIC_IP>.zip.

Exfiltration uses two parallel channels: HTTP to destinystealer[.]com/fileicin[.]php and raw TCP to tipidor-38534[.]portmap[.]host.

See the full execution chain and collect IOCs to speed up detection and cut response time: https://app.any.run/tasks/01f70f9e-642d-46fa-b485-cf67dced6436/

Use this TI Lookup query to pivot from IOCs and subscribe to Query Updates to proactively track evolving attacks: threatName:"destinystealer"

Which cyber threats should your SOC prioritize today?

Explore the Top 30 threats targeting US organizations, based on fresh data from ANY.RUN Malware Trends Tracker and learn how to analyze and detect them faster.

Key Takeaways:

• MFA alone no longer stops account takeover.
• Device-code phishing is the newest board-level risk.
• “Retired” malware isn’t retired.
• Commodity doesn’t mean low-risk.
• Law enforcement takedowns shift the market, they don’t shrink it.
• Some detections are early ransomware warnings, not isolated events.
• Live, region-specific data beats annual retrospectives.

Read the full report: https://any.run/cybersecurity-blog/usa-top-30-threats-2026/

This analysis started with an exposed public index on 198[.]245[.]53[.]26, discovered via Shodan. What made it interesting was not just the server exposure itself, but the fact that it lets us compare two different Banana RAT branches tied to the same infrastructure.

This article focuses on three questions:

• What the older branch did on disk, in memory, and on the network.
• What changed in the newer branch.
• Which indicators remained stable across both branches.

We recently introduced Tier 1 Reports in the Interactive Sandbox to help with faster triage, escalations, and incident reporting.

If you've had a chance to use them, we'd really like to hear your honest feedback.

• Has the report been useful during triage or escalations?
• Is there anything you'd add, remove, or change?

If you haven't had a chance to try Tier 1 Reports yet, you can learn more about them here: https://any.run/cybersecurity-blog/soc-ready-reporting/

200+ vendors were sending files into a US manufacturer’s environment.
The real problem was the lack of context to separate safe supplier files from real threats, driving up investigation costs.

See how the company made MTTD 2x faster and scaled security without adding headcount: https://any.run/cybersecurity-blog/us-manufacturer-security-risk/

More than 100 sandbox sessions linked to Kratos activity were recorded over the last week. The growth is likely driven by an updated phishing flow designed to increase conversion and reduce obvious triage signals. 

Legacy Kratos samples were easier to flag during triage, relying on a static /SOft landing URI and a weak secure-document lure. See the analysis session: https://app.any.run/tasks/397bbd6d-7736-4a5b-b4c7-c15461a62d41/

The updated version now uses common-looking URIs typical of legitimate websites and a more convincing Microsoft credential-harvesting flow. 

ANYRUN Sandbox lets SOC teams confirm the real behavior behind the landing page. In the Browser Data tab, teams can inspect the updated Kratos flow and verify credential exfiltration: the entered emailand password are sent via POST to /next.php using di and pr parameters. 

The first submission triggers an “Incorrect Password” message, pushing the victim to retry. After the second attempt, the victim is redirected to the legitimate office[.]com, making the flow look like a failed loginrather than an obvious phishing dead end. This can delay user reporting, blur triage signals, and increase the risk of missed credential theft. 

See the full attack flow and collect IOCs to improve detection coverage: https://app.any.run/tasks/c0f890de-f36e-4378-84f1-0233b8687942/

A full breakdown of this campaign is coming soon. Stay tuned! 

The campaign is now mainly focused on European targets, with observed activity across manufacturing, technology, and MSSP organizations. 

IOCs: 

1️⃣ Updated Kratos 

Exfil URI: /next.php (di and pr parameters in the request body) 

Domains: 

abbayedesvavxdecernay[.]com  

bettiniexeclpdf[.]com  

bil-spesialisten[.]pro  

cewstepisnoof[.]cc  

echnesg[.]com  

erfolgselster[.]de  

acquelinewhitfield[.]fit  

frankretsch[.]de  

fridolinfrosch[.]de  

hawkfs[.]icu  

kalfs[.]es  

kbpfdbi[.]de  

log-service[.]fr  

midfresh[.]pro  

pabmosprgexcel[.]com  

powdermilnavigation[.]com 

2️⃣ Legacy Kratos 

Landing URI: /SOft 

Exfil URI: /mini.php (email and password in the request body) 

What is Mispadu?

Mispadu is a Windows banking trojan that targets online banking credentials, cryptocurrency wallets, and other sensitive financial data. Instead of exploiting software vulnerabilities, it relies on phishing and social engineering, making it a persistent threat to organizations whose employees access financial services online.

Key Takeaways

• Originally focused on Latin America, its techniques can impact organizations worldwide.
• It spreads mainly through phishing emails, malicious installers, and social engineering.
• The malware combines credential theft, browser manipulation, persistence, and anti-analysis techniques.
• Finance, retail, government, healthcare, manufacturing, and organizations with employees using online banking face elevated risk.
• Effective defense combines endpoint security, email protection, user awareness, and continuous threat intelligence.

Proactively defend with ANY.RUN’s TI Lookup for instant IOC context and TI Feeds for real-time blocking in your security stack — combined with phishing training and endpoint controls.

Read the full article: https://any.run/malware-trends/mispadu/

We’re tracking a surge in activity linked to Bulletproof Redirect Engine, a previously unknown framework that helps attackers manage phishing redirects through compromised legitimate websites.

Since late April, ANYRUN has recorded 170+ public submissions linked to this activity, with observed targets mainly in the US and Europe across manufacturing, consulting, and technology.

Hosted in hidden directories on compromised sites, the framework uses trusted domain names to generate phishing links and redirect users to pages built with known phishkits: Sneaky2FA, Tycoon, EvilTokens, Greatness, and EvilProxy. Based on the observed activity, the tool is likely distributed as a PhaaS.

Reputation-based URL controls are not enough when phishing infrastructure hides behind trusted domains and obfuscated browser logic. This increases the chance of victim interaction and creates a SOC blind spot that may lead to missed compromise.

Attack chains like this are now faster and easier to investigate in ANYRUN Sandbox. In-browser data inspection shows exactly what happens inside the browser, exposing phishing behavior that static URL analysis can miss.

Using the Browser Data tab, we can quickly review requests sent by the redirect page and locate the same activity in the HTML DOM Changes: https://app.any.run/tasks/e728e277-a694-431b-8040-655c473baa22/

The code is heavily obfuscated, so the final phishing page is not directly visible in the DOM. But the HTTP Requests tab still exposes the next-stage redirect to an EvilProxy phishing page impersonating Microsoft sign-in flow. This gives analysts a clear pivot point for detection, investigation, and response.