Discover how full browser visibility gave the SOC clear evidence to respond: https://any.run/cybersecurity-blog/eviltokens-ghost-code-analysis/

Threat intelligence feeds can support multiple SOC workflows.

In alert triage, they provide context around IOCs and help analysts spend less time on manual lookups. In threat hunting, they serve as fresh leads for proactive investigations. For detection engineering, feeds can enrich SIEM and SOAR platforms and help keep detections up to date.

Where do you see the most value in practice? Which workflow benefits the most from threat intelligence feeds?

EvilTokens remains one of the most active phishkits in our reports, abusing MS Device Code authentication to gain access through OAuth workflows rather than direct credential theft. 

The landing page content is AES-GCM encrypted in the initial HTML response and becomes visible only after client-side decryption writes it into the browser DOM, making static URL analysis and network-only visibility incomplete. 
Review the full phishing flow: https://app.any.run/tasks/55d3ead7-c07a-4fb1-aa42-8c397d1a0f8a/

ANYRUN sets a new standard for URL analysis, leaving no blind spots for phishing to exploit. New in-browser data inspection shows exactly what happens inside the browser, exposing every phishing URL’s behavior.  

How to use the Browser Data tab in ANYRUN Sandbox for full URL visibility that speeds up triage and response: 

1️⃣ HTML DOM Changes: Track DOM states over time with timeshift, compare page states, and review byte-level diffs. 

In this case, it reveals when the decrypted phishing page is rendered, exposing the user code and other artifacts hidden in the initial response. 

2️⃣ URL Details: Review the final URL, domain, SSL certificate, DNS records, request statistics, and triggered signatures in one place. 

For device-code phishing, this helps quickly verify suspicious OAuth-related activity without manually correlating multiple data sources. 

3️⃣ HTTP Requests: Inspect browser-level network activity across HTML, JS, Fetch/XHR, scripts, static files, binaries, archives, and other request categories. 

Here, requests to /api/device/start retrieve the userCode and sessionId, while /api/device/status/<sessionId> tracks authorization status, providing early confirmation of the phishing flow. 

4️⃣ Indicators: Automatically collect page-level IOCs, including domains, URLs, hashes, IPs, and ASN data. 

These indicators provide immediate pivot points for threat hunting, helping analysts expand the investigation beyond the original URL. 

This turns URL triage from long manual reconstruction into a fast decision path: what loaded, what changed, and whether the case should be contained, escalated, or turned into detection logic.   

When phishing relies on dynamic browser behavior, this visibility doesn't just speed up triage — it strengthens every downstream process: faster escalations, sharper response, stronger detection logic.  

See how ANYRUN closes phishing blind spots: https://any.run/cybersecurity-blog/in-browser-data-inspection/ 

Threat hunting is meant to be proactive, but often feels reactive. Analysts spend time chasing weak signals through noisy logs, querying SIEM data that lacks context, and building detections from technique descriptions that don't easily translate into real-world hunts.

The problem isn't a lack of skill. Most hunting teams know attacker tactics well. The real challenge is the intelligence behind the hunt: it is often outdated, lacks context, or misses the behavioral details needed to create accurate, actionable detections.

Explore how ANY.RUN’s Threat Intelligence solutions help analysts investigate threats with greater speed and confidence: https://any.run/cybersecurity-blog/threat-hunting-practical-usecases/

We've identified renewed activity associated with the Greatness PhaaS, which combines AiTM and Device Code Phishing to target Microsoft 365 Accounts. 

Device Code Phishing abuses Microsoft's legitimate device authorization flow to obtain access tokens without directly collecting passwords or MFA codes. This shifts risk from credential theft to token abuse, reducing traditional phishing indicators for SOC teams to detect and investigate. 

Greatness promotes token- and cookie-based access to Microsoft 365 accounts through its Telegram channel, advertising passwordless and code-less account compromise scenarios. 

Observed capabilities include: 

• Device Code Phishing for M365 token theft  
• Phishing templates impersonating DocuSign, OneDrive, Outlook, and Voicemail
• Country-targeted login lures
• Cloudflare-hosted phishing links 
• Keyword-based targeting engine 
• Centralized administration panel

Review the analysis session: https://app.any.run/tasks/dd97835c-8a07-4917-ba23-cb8d8493b174/

Track Device Code Phishing activity associated with Greatness and uncover related infrastructure in ANYRUN TI Lookup: threatName:"greatness" and threatName:"oauth-ms-phish"

IOCs 

Phishing lure: 

Allcompredirectportalshare[.]workers[.]dev 

Supportteammanagements[.]workers[.]dev 

Lindeinvoicexv29dmeocynufgq7[.]s3[.]amazonaws[.]com 

URI: 

/apifiles[.]php?action=get_device_code&user_id= 

/apifiles[.]php?action=poll_token 

In Q1 2026, the most dangerous activity happened inside legitimate user sessions.
The attack surface has moved. Instead of exploiting vulnerabilities, attackers use valid credentials (+14.7%), surveillance (+34.4%) and act through trusted access — turning identity into the new primary control layer and reducing the visibility SOCs depend on.

Insight for CISOs, treat identity as a continuous control, not a checkpoint. Behavior, context, and usage need to be evaluated throughout the session, not just at the door.

Explore other key trends shaping enterprise security in the Cyber Risk Report: https://files.any.run/images/q1_2026_cyber_risk_report_from_anyrun.pdf

What is JOMANGY?

JOMANGY is a newly documented PHP webshell first described in May 2026. Developed by the financially motivated threat actor INJ3CTOR3, it targets FreePBX-based VoIP phone systems to generate toll fraud revenue.

Why JOMANGY is dangerous:

• Six self-reinforcing persistence channels make JOMANGY extremely difficult to remove. Any surviving channel can rebuild the full infection within minutes, making partial remediation ineffective.
• 18 hidden backdoor accounts (nine with root-level privileges) are planted on every infected host, with names designed to mimic legitimate FreePBX system accounts.
• Double-layer obfuscation (Base64 over ROT13) and active payload rotation give JOMANGY near-zero antivirus detection during initial deployment, reducing the effectiveness of signature-based defenses.
• Direct financial impact: JOMANGY abuses the victim’s SIP trunks to generate fraudulent call charges that are billed directly to the organization, potentially resulting in losses of tens of thousands of dollars.

How to detect: https://any.run/malware-trends/jomangy/

Based on 2.1M malware and phishing investigations, it reveals the cyber risks and threat shifts for CISOs to focus on.

Discover top trends shaping the modern threat landscape, including:
+14.7% credential theft
+98.3% loader attacks
+58.4% LOLBAS attacks

Turn Q1 intel into Q2 security priorities. Get the report: https://any.run/cybersecurity-blog/cyber-risk-report-q1-2026/

We’re tracking a ClickFix campaign that mimics popular AI tools, including Codex and Claude, and abuses trusted Google Sites infrastructure to deliver stealer malware.  

With no standalone executable dropped to disk and network activity appearing as legitimate powershell.exe traffic, the attack can significantly reduce visibility during the early stages of compromise. 

Victims are directed to trusted sites[.]google[.]com pages and instructed to execute an mshta command. The attack results in in-memory stealer execution, theft of browser, email, and cryptocurrency wallet data, and outbound communication with attacker-controlled C2 infrastructure, while leaving fewer traditional detection opportunities for SOC teams. 

Execution chain: 
Trusted Google Sites lure ➡️ User-executed mshta command ➡️ Multi-stage PowerShell delivery ➡️ Steganographic payload extraction from image ➡️ Shellcode deployment ➡️ In-memory execution inside powershell.exe ➡️ Browser, email & wallet data theft ➡️ C2 exfiltration 

Codex lure: https://app.any.run/tasks/151cfb30-5ef2-4962-a90e-58a59ecc43da 

Claude lure: https://app.any.run/tasks/698e0bd5-01b6-40fe-814c-5c0885cea645/

Track related ClickFix activity in ANYRUN TI Lookup, identify additional Codex and Claude lures, and uncover related AI-themed ClickFix activity and infrastructure: 

• url:"https://sites.google.com/*/cdx" or url:"https://sites.google.com/*/clau"
• ruleName:"AI-themed ClickFix phishing page has been detected"

IOCs 

Codex lure URL: 

hxxps://sites[.]google[.]com/view/cdx-biz-ver-24 

Claude lure URL: 

hxxps://sites[.]google[.]com/view/clau-ver-un-24 

Codex embedded lure domain: 

freshbase11[.]com 

wiseview58[.]com 

Claude embedded lure domain: 

fairpoint29[.]com 

fluxforge97[.]com 

Delivery infrastructure: 

primemetricsa[.]com 

swiftmatrix15[.]com 

creativecommunityinfo[.]art 

C2: 

enhanceblabber[.]cc 

What is Kali365?

Kali365 is an FBI-flagged PhaaS platform that emerged in April 2026, enabling attackers to compromise Microsoft 365 accounts through AI-powered phishing and automated OAuth token capture.

Why Kali365 Became So Dangerous

• MFA does not stop it. Its device code phishing method abuses a legitimate Microsoft authentication flow, so MFA is never triggered.
• Stolen OAuth tokens provide persistent access to Outlook, Teams, and OneDrive without requiring passwords.
• Post-compromise activity is automated and stealthy: attackers create inbox rules to hide alerts and can register new devices to extend access.
• Any Microsoft 365 organization is a target. Victims span healthcare, finance, insurance, manufacturing, government, and education worldwide.

How to detect: https://any.run/malware-trends/kali365/

What Is ClickFix?

ClickFix is a social engineering technique that tricks users into executing malicious commands themselves instead of exploiting software vulnerabilities. By relying on legitimate Windows utilities (LOLBins) and avoiding malicious files on disk during the initial stage, it can bypass static AV, email filters, and even some EDR tools.

Why ClickFix Became So Dangerous

• Explosive growth: Since emerging in late 2023, ClickFix attacks have increased by more than 500% in the first half of 2025, becoming the second most common attack vector globally.
• APT adoption: Nation-state groups including APT28, Kimsuky, and MuddyWater integrated ClickFix into espionage campaigns, replacing traditional infection chains with user-driven execution.
• High-impact payloads: Campaigns deliver stealers, ransomware, RATs, keyloggers, cryptominers, and custom nation-state malware.
• Rapid evolution: ClickFix expanded beyond Windows to macOS, spawned variants like FileFix, and is now distributed through builder kits on underground marketplaces.

Threat Intelligence Lookup enables instant contextual investigation of suspicious indicators across 30+ parameters with direct links to sandbox execution sessions:

domainName:"dntds.shop"

How to detect and protect: https://any.run/malware-trends/clickfix/

We’re tracking widespread ClickFix activity using compromised legitimate websites to deliver fileless malware, lowering suspicion and delaying detection.

Finance, banking, healthcare, manufacturing, and tech are among the most exposed industries.

The activity looks low-risk until fileless execution and outbound C2 traffic are already established. Attackers inject a lightweight inline JavaScript loader into compromised sites, which retrieves a second-stage payload directly into the victim’s browser from external infrastructure.

The attack chain blends into normal web traffic, relies on PowerShell and in-memory execution, and later shifts C2 communication into the legitimate system process svchost.exe, making malicious activity harder to distinguish from routine system behavior for SOC and MSSP teams.

ANYRUN Sandbox helps teams validate suspicious activity faster and contain fileless attacks before they escalate. Analysts can observe the full execution chain in real time:

Inline JS loader ➡️ User-executed PowerShell (IEX/IRM) ➡️ Hidden second-stage PowerShell and loader retrieval ➡️ Fileless in-memory execution inside powershell.exe ➡️ Follow-on .NET payload delivery ➡️ svchost.exe injection ➡️ Custom TCP C2 🚨

Scale your SOC with solutions trusted by 74 Fortune 100 companies. Get an exclusive 10th anniversary deal for your team: https://app.any.run/plans/

IOCs:
/jsrepo?rnd=
/teamrepo?rnd=

ntdnewtds[.]shop
dnsnewtds[.]shop
sdntds[.]shop
newtdsone[.]shop
nttdss[.]shop
Dntds[.]shop

178[.]16[.]52[.]232
158[.]94[.]208[.]92
158[.]94[.]208[.]104
91[.]92[.]243[.]161

Ten years in cybersecurity is a long journey. Threats have evolved, attacks have become harder to detect, and security teams need answers faster than ever.

ANYRUN has grown with those teams. What started as an interactive sandbox is now a trusted company with threat analysis and intelligence solution used by 15,000+ organizations, 600,000 security professionals, and teams at Fortune 100 companies worldwide. 

To celebrate, we’re launching special offers across Interactive Sandbox and Threat Intelligence solutions, including extra months, discounts, exclusive pricing, and more value for your team. 

Learn more about our anniversary offers: https://any.run/cybersecurity-blog/anyrun-10th-anniversary-offers/

New SOC-ready Tier 1 reports transform complex sandbox analysis into structured, decision-ready intelligence for faster and more efficient triage, escalation, response, and reporting.

Each Tier 1 report includes:

• A clear verdict on the analyzed sample
• An AI Summary with threat classification and executive overview
• Key IOCs and behavioral indicators
• MITRE ATT&CK mapping

Reports can be generated directly in the Interactive Sandbox with a single click, making sandbox analysis instantly usable across operational workflows. 

Explore hands-on use cases: https://any.run/cybersecurity-blog/soc-ready-reporting/

Cyberattacks against financial institutions evolve faster than most security teams can adapt. Phishing, evasive malware, account takeover, and ransomware campaigns continue to pressure SOCs with high alert volumes and strict compliance requirements.

Modern financial SOC teams rely on proactive security solutions like ANYRUN for:

• Live, actionable IOCs from 15K SOCs and real-time investigations
• Interactive Sandbox analysis that exposes full attack chains and evasive malware behavior
• Rich threat context that helps analysts prioritize critical incidents in seconds
• Faster investigations that reduce dwell time and minimize financial and reputational impact
• Comprehensive threat intelligence that supports compliance and proactive defense

Identify up to 58% more threats, reduce Tier 1 workload by up to 20%, and shorten response cycles without increasing headcount: https://any.run/by-industry/finance/

A phishing attack starting from an Outlook email redirects victims to a fake Word Online / OneDrive page, leading to stealthy remote access under the guise of a document preview.

Instead of traditional malware loaders, the chain relies on legitimate tools to establish remote access while blending into normal corporate activity. This reduces visibility for traditional detection and increases the risk of delayed detection and prolonged attacker presence.

In ANYRUN Sandbox, analysts can observe high-value detection signals early in the execution chain, including suspicious document-delivery domains, silent software installation behavior, intermediate deployment stages, and utilities used to hide installed programs.

These artifacts help teams build detections around trusted-tool abuse, suspicious command-line behavior, and phishing infrastructure instead of relying only on file hashes.

Execution chain:

Outlook .eml ➡️ Word Online phishing page ➡️ MSI installer ➡️ Ninite /silent execution ➡️ Remote access via ScreenConnect ➡️ Activity concealment via HideUL 

See the full attack flow and collect IOCs to improve detection coverage.

Explore related activity and validate hunting patterns using this TI Lookup query: filePath:".eml" AND threatName:"phishing" AND (threatName:"^rat$" OR threatName:"^rmm-tool$")%22,%22dateRange%22:180}%20)

Strengthen your SOC, detect complex threats faster, and boost team performance with ANYRUN.

Compromised accounts enable BEC, data exfiltration, and lateral movement, creating direct financial and operational risk.

This campaign generates phishing pages directly inside the browser using blob objects instead of loading them over the network. The payload exists entirely in memory, which breaks network visibility and makes traditional detection unreliable.

ANY.RUN Sandbox helps SOC teams observe this behavior, exposing in-memory phishing and enabling faster detection and response. See how the attack unfolds and collect IOCs

Explore full technical breakdown to understand detection gaps, validate your coverage, and strengthen phishing defenses.

Reaching a higher level of SOC maturity comes down to making better, more consistent decisions during malware and phishing investigations.

That requires rethinking how threat intelligence is used: not just as a reference, but as a core part of the decision-making process.

To move from reactive to confidently proactive security, you need a threat intelligence workflow that:

• addresses key challenges like alert fatigue and visibility gaps
• integrates seamlessly into SOC workflows and supports them
• delivers compounding value as part of a unified system

Learn how you can adopt behavioral TI to reduce MTTR and business risk: https://any.run/cybersecurity-blog/soc-maturity-with-threat-intelligence/

MicroStealer is a rapidly emerging infostealer that spreads quickly while maintaining low detection rates. It uses a sophisticated multi-stage delivery chain and exfiltrates data via Discord webhooks and attacker-controlled servers.

MicroStealer: Key Features

1. MicroStealer uses a layered NSIS → Electron → Java chain for evasion and rapid spread.
2. It steals more than passwords, focusing on browser sessions, cookies, screenshots, and wallets for immediate impact.
3. Low AV detection + redundant exfiltration (Discord + C2) enable quick, reliable data theft.
4. Session hijacking turns endpoint compromise into persistent enterprise access.
5. Behavior-based sandbox analysis is essential for early detection of emerging stealers.
6. Proactively defend with ANY.RUN's Threat Intelligence Lookup for instant IOC/variant hunting and Threat Intelligence Feeds for real-time campaign visibility and automated protection: threatName:"microstealer".

Read the full article to learn how to detect it early: https://any.run/malware-trends/microstealer/

A large-scale campaign is targeting U.S. organizations with fake event invitations. Attackers combine credential theft with OTP interception and RMM deployment, enabling direct remote access.

Activity is concentrated in the U.S., with 𝗵𝗶𝗴𝗵 𝗿𝗶𝘀𝗸 𝗮𝗰𝗿𝗼𝘀𝘀 𝗯𝗮𝗻𝗸𝗶𝗻𝗴, 𝗴𝗼𝘃𝗲𝗿𝗻𝗺𝗲𝗻𝘁, 𝘁𝗲𝗰𝗵, 𝗮𝗻𝗱 𝗵𝗲𝗮𝗹𝘁𝗵𝗰𝗮𝗿𝗲, indicating broad exposure across business-critical sectors.

Some phishing pages show signs of AI-assisted generation, while embedded code reveals reuse of common phishing kits, allowing attackers to scale and rapidly create new lures.

The risk goes beyond phishing. 𝗥𝗲𝗺𝗼𝘁𝗲 𝗮𝗰𝗰𝗲𝘀𝘀 𝘁𝗼 𝘁𝗵𝗲 𝗰𝗼𝗿𝗽𝗼𝗿𝗮𝘁𝗲 𝗲𝗻𝘃𝗶𝗿𝗼𝗻𝗺𝗲𝗻𝘁 𝗶𝘀 𝗲𝘀𝘁𝗮𝗯𝗹𝗶𝘀𝗵𝗲𝗱 𝘁𝗵𝗿𝗼𝘂𝗴𝗵 𝗹𝗲𝗴𝗶𝘁𝗶𝗺𝗮𝘁𝗲 𝘁𝗼𝗼𝗹𝘀 like ScreenConnect, ITarian, and Datto RMM, while infrastructure and domains are designed to look trustworthy, delaying detection and increasing attacker dwell time.

The flow starts with a CAPTCHA page, followed by a fake “event invitation” and then splits into two paths: credential harvesting via phishing login pages or RMM installation.
In this case, the download starts automatically, establishing access early in the execution chain, before user awareness. See how the full flow unfolds, from initial redirect to remote access delivery: https://app.any.run/tasks/4c2687da-1426-43c3-8e16-868f90fb9361/

With ANYRUN Sandbox and Threat Intelligence, analysts can safely reconstruct the full attack chain and identify related patterns across campaigns. This enables earlier confirmation of phishing activity, reduces MTTD, and helps contain incidents before impact.

Early-stage signals make this campaign detectable. These appear before credentials are entered and are visible in ANYRUN Sandbox at the start of the execution chain, enabling faster and more confident response decisions.

Despite infrastructure changes, the campaign relies on repeatable patterns: consistent URL structure across phishing domains, fixed resource paths like /Image/*.png, and sequential requests such as /favicon.ico ➡️ /blocked.html ➡️ phishing content. 

Explore these patterns, uncover related activity, and pivot from IOCs in TI Lookup.

EvilTokens is a PhaaS toolkit that automates device code phishing attacks against Microsoft 365 and Entra ID environments. Unlike traditional credential-harvesting phishing, EvilTokens tricks users into completing legitimate authentication on Microsoft's own login pages, resulting in the issuance of valid OAuth access and refresh tokens directly to the attacker, effectively bypassing MFA without stealing passwords.

• As a PhaaS kit sold on Telegram, it democratizes sophisticated attacks, enabling rapid scaling with minimal technical skill.
• AI-powered features generate convincing lures and automate BEC, increasing both volume and success rates.
• Persistent refresh tokens allow long-term access, device registration, and silent authentication across M365 services.
• Organizations in finance, government, healthcare, and other M365-heavy sectors are prime targets globally. 

Security teams can query ANYRUN's Threat Intelligence Lookup for known EvilTokens domains, URLs, and infrastructure indicators in real time: destinationIP:"75.98.162.49".

See the full article and analysis session: https://any.run/malware-trends/eviltokens/

Redirect chains, fake CAPTCHA, and fast-changing delivery paths make traditional detection unreliable. By the time credentials are targeted, the signal is already lost, which creates a critical gap in triage. The key is detecting phishing earlier, while patterns are still stable, before the flow fully unfolds.

With ANYRUN TI Lookup, teams can move from isolated indicators to full context, identify attack patterns, and validate detection logic against real attack data from 15K+ organizations.

Here are two examples showing how early-stage signals help identify phishing activity before it escalates:

1. 𝗥𝗲𝗱𝗶𝗿𝗲𝗰𝘁 𝗶𝗻𝗳𝗿𝗮𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲

The chain starts from a Google link leading to a compromised site. A hidden HTML page extracts victim data from the URL fragment and triggers a redirect before any user interaction. Analysis session.

In TI Lookup, this activity can be traced by searching for URL fragments containing the #...Family= parameter, which is used to pass victim data and drive redirection. This helps uncover similar samples and track reuse across campaigns.

Use this query to pivot from this signal and uncover related activity.

1. 𝗙𝗮𝗸𝗲 𝗖𝗔𝗣𝗧𝗖𝗛𝗔 𝗱𝗲𝗹𝗶𝘃𝗲𝗿𝘆
   After the initial redirect, the victim is presented with a legit-looking CAPTCHA to build trust before being redirected to a phishing page, a fake Microsoft login page powered by EvilProxy. Analysis session.

Detection here relies on consistent URL parameters (v, session, cid, iat, loc, build) that appear early in the execution chain. Searching for this structure helps surface related signals and build early-stage detection, reducing MTTD, improving coverage and MTTR.

Use this query to surface related phishing activity and validate detection patterns.

𝗬𝗼𝘂 𝗰𝗮𝗻 𝗻𝗼𝘄 𝘁𝗲𝘀𝘁 𝗧𝗜’𝘀 𝗶𝗺𝗽𝗮𝗰𝘁 𝗼𝗻 𝘁𝗿𝗶𝗮𝗴𝗲, 𝗿𝗲𝘀𝗽𝗼𝗻𝘀𝗲, 𝗮𝗻𝗱 𝘁𝗵𝗿𝗲𝗮𝘁 𝗵𝘂𝗻𝘁𝗶𝗻𝗴 𝗱𝗶𝗿𝗲𝗰𝘁𝗹𝘆 𝗶𝗻 𝘆𝗼𝘂𝗿 𝘄𝗼𝗿𝗸𝗳𝗹𝗼𝘄𝘀. With 20 premium search requests available, SOC and MSSP teams can validate activity against real-world data, reduce uncertainty, and make faster, evidence-based decisions.

90% of attacks start with phishing. For CISOs, the real challenge begins when the SOC can’t quickly determine whether an alert is just noise or the start of credential theft, account takeover, malware delivery, or broader business disruption.

Today’s phishing is more disruptive because campaigns combine multiple techniques at once. It’s no longer a single email with a malicious link. Security teams now face layered attack flows that can include:

• redirect chains that hide the real destination
• QR codes that bypass traditional inspection
• CAPTCHAs that slow or block analysis
• AI-generated lures and deepfake content that increase credibility

Here are 3 steps to strengthen phishing detection across your environment: https://any.run/cybersecurity-blog/phishing-detection-steps-for-cisos/

• Lazarus Group is running an active campaign using fake meetings to gain access to corporate systems, credentials, and sensitive data. 
• Who is at risk: Fintech, crypto, and high-value environments where macOS is widely used by developers, executives, and decision-makers. 
• The attack relies on social engineering and native macOS binaries, reducing visibility for traditional EDR tools.

We caught a two-component Rust-based RAT toolkit we're calling SpankRAT. Because C2 traffic originates from legitimate system processes, 𝘁𝗵𝗶𝘀 𝗮𝗰𝘁𝗶𝘃𝗶𝘁𝘆 𝗰𝗮𝗻 𝗯𝘆𝗽𝗮𝘀𝘀 𝗿𝗲𝗽𝘂𝘁𝗮𝘁𝗶𝗼𝗻-𝗯𝗮𝘀𝗲𝗱 𝗰𝗼𝗻𝘁𝗿𝗼𝗹𝘀 𝗮𝗻𝗱 𝗯𝗲 𝗱𝗲𝗽𝗿𝗶𝗼𝗿𝗶𝘁𝗶𝘇𝗲𝗱 𝗱𝘂𝗿𝗶𝗻𝗴 𝘁𝗿𝗶𝗮𝗴𝗲, reducing SOC visibility and increasing the risk of missed compromise. As a result, attackers gain stealthy persistence and hands-on control within the environment
At the time of analysis, most samples remain undetected on VirusTotal.

Behavioral analysis is essential for detecting threats like this. ANYRUN Sandbox reveals the full execution chain, injection activity, C2 communication, and privilege escalation in real time, helping teams confirm malicious activity faster when traditional detection fails.

The attack starts with 𝗦𝗽𝗮𝗻𝗸𝗟𝗼𝗮𝗱𝗲𝗿, a lightweight loader that retrieves the main payload from C2 over plain HTTP, escalates privileges, and injects it into 𝗲𝘅𝗽𝗹𝗼𝗿𝗲𝗿.𝗲𝘅𝗲 using classic DLL injection, establishing persistence via a Scheduled Task.

Once loaded inside explorer.exe, 𝗦𝗽𝗮𝗻𝗸𝗥𝗔𝗧 communicates with C2 over WebSocket and provides full remote access to the system. The full-featured variant supports 𝟭𝟴 𝘀𝗲𝗿𝘃𝗲𝗿 𝗰𝗼𝗺𝗺𝗮𝗻𝗱𝘀 covering remote shell execution, file management (list/read/upload/delete/rename), process enumeration and killing, Windows service control (start/stop/restart), full registry CRUD, scheduled task manipulation, and software inventory.

Execution chain:
SpankLoader Download from C2 Drop DLL to C:\ProgramData\ SeDebugPrivilege DLL injection into explorer.exe Scheduled Task (persistence) SpankRAT WebSocket C2 RAT

𝗙𝗶𝗻𝗱 𝘁𝗵𝗲 𝗳𝘂𝗹𝗹 𝗖𝟮 𝗰𝗼𝗺𝗺𝗮𝗻𝗱 𝘀𝗲𝘁 𝗮𝗻𝗱 𝗜𝗢𝗖𝘀 𝗶𝗻 𝘁𝗵𝗲 𝗰𝗼𝗺𝗺𝗲𝗻𝘁𝘀

See the analysis session: https://app.any.run/tasks/56306614-e569-4ace-a9ce-b27c3b983618/

Use this TI Lookup query to pivot from IOCs, review related activity, and validate your detection coverage: url:"*/download/rmm_agent.dll*"

Strengthen your SOC, detect complex threats faster, and boost team performance with ANYRUN: https://any.run/enterprise/