ANY.RUN

Empowering businesses with proactive security solutions: Interactive Sandbox,
TI Lookup and Feeds. Sign up:

[ANY.RUN @anyrun_app]

🚀 BIG NEWS: Full URL triage now takes a single click.

Domain data, dynamic DOM changes, hidden scripts — all visible under Browser Data tab. No more slow investigations. Just see & decide to escalate or close the alert.

Try ultra-fast phishing analysis: https://t.co/StmzR446ad

[ANY.RUN @anyrun_app]

🚀 We're an official @torq_io AMP partner!

Together, we help security teams move from alerts to evidence-backed decisions faster, combining Torq’s automation with #ANYRUN’s real-time malware & phishing analysis and threat intelligence ⚡️

Learn more: https://t.co/3esMAaMb2H

[ANY.RUN @anyrun_app]

⏱️ Lack of alert context costs your SOC time and money.

⚡️ #ANYRUN’s integration for @torq_io helps replace guesswork with high-confidence verdicts and intelligence to slash your MTTR by 21 mins per case.

Streamline your triage and response 👇
https://t.co/QQLMOjsLjD

[ANY.RUN @anyrun_app]

🎯 Walk through a real phishing case with the complete browser-level execution to see it in action: https://t.co/Ev8WhLxynH

[ANY.RUN @anyrun_app]

⚠️ Static detection has limited reach into modern phishing.

#ANYRUN's in-browser data inspection catches every DOM mutation, script execution, redirect, and injected form.

👨‍💻 Discover the new standard for URL analysis: https://t.co/t2FqXcTgdE

[ANY.RUN @anyrun_app]

🚨 𝗡𝗲𝘄 𝗥𝗲𝗱𝗶𝗿𝗲𝗰𝘁 𝗙𝗿𝗮𝗺𝗲𝘄𝗼𝗿𝗸 𝗧𝘂𝗿𝗻𝘀 𝗟𝗲𝗴𝗶𝘁𝗶𝗺𝗮𝘁𝗲 𝗪𝗲𝗯𝘀𝗶𝘁𝗲𝘀 𝗜𝗻𝘁𝗼 𝗣𝗵𝗶𝘀𝗵𝗶𝗻𝗴 𝗜𝗻𝗳𝗿𝗮𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲
We’re tracking a surge in activity linked to Bulletproof Redirect Engine, a previously unknown framework that helps attackers manage #phishing redirects through compromised legitimate websites.

❗️ Since late April, #ANYRUN has recorded 170+ public submissions linked to this activity, with observed targets mainly in the US and Europe across manufacturing, consulting, and technology.

⚠️ Hosted in hidden directories on compromised sites, the framework uses trusted domain names to generate phishing links and redirect users to pages built with known phishkits: #Sneaky2FA, #Tycoon, #EvilTokens, Greatness, and EvilProxy. Based on the observed activity, the tool is likely distributed as a PhaaS.

Reputation-based URL controls are not enough when phishing infrastructure hides behind trusted domains and obfuscated browser logic. This increases the chance of victim interaction and creates a SOC blind spot that may lead to missed compromise.

⚡️ Attack chains like this are now faster and easier to investigate in #ANYRUN Sandbox. In-browser data inspection shows exactly what happens inside the browser, exposing phishing behavior that static URL analysis can miss.

👨‍💻 Using the Browser Data tab, we can quickly review requests sent by the redirect page and locate the same activity in the HTML DOM Changes: https://t.co/pobLzcgv55

The code is heavily obfuscated, so the final phishing page is not directly visible in the DOM. But the HTTP Requests tab still exposes the next-stage redirect to an #EvilProxy phishing page impersonating Microsoft sign-in flow. This gives analysts a clear pivot point for detection, investigation, and response ✅

🚀 Expose phishing activity hidden behind trusted infrastructure and obfuscated browser logic, then turn it into faster triage, sharper response, and stronger detection rules. See how #ANYRUN closes phishing blind spots: https://t.co/nANS7uDw4I

#ExploreWithANYRUN

[ANY.RUN @anyrun_app]

@xabdul Appreciate you sharing, Abdulrahman!

[ANY.RUN @anyrun_app]

⚠️ According to #ANYRUN Threat Intelligence data, recent EvilTokens activity is concentrated mainly in the United States and Europe. View the regions and industries at risk using this TI Lookup search query: https://t.co/hk1by5Wsjk

[ANY.RUN @anyrun_app]

🚨 #EvilTokens can turn a missed browser event into a M365 account takeover. Its “ghost” code stays hidden from static analysis, extending exposure.

⚡️ 1 minute was enough to reveal the attack flow. Explore the analysis session: https://t.co/XuTTFM7LR2

👨‍💻 Discover how full browser visibility gave the SOC clear evidence to respond: https://t.co/BH2cvrD6KH

[ANY.RUN @anyrun_app]

⚠️ 𝗜𝗳 𝘁𝗵𝗲 𝗴𝗮𝘁𝗲𝘄𝗮𝘆 𝗳𝗹𝗮𝗴𝗴𝗲𝗱 𝗻𝗼 𝗽𝗵𝗶𝘀𝗵𝗶𝗻𝗴, 𝗵𝗼𝘄 𝗱𝗶𝗱 𝘁𝗵𝗲 𝘂𝘀𝗲𝗿 𝗿𝗲𝗮𝗰𝗵 𝘁𝗵𝗲 𝗽𝗮𝘆𝗹𝗼𝗮𝗱 𝗽𝗮𝗴𝗲?

Modern phishing attacks are engineered to pass static checks. The first link looks clean. The final page — credential form, redirect chain, injected scripts — never gets inspected.

🚀 #ANYRUN’s in-browser data inspection closes the visibility gap by showing what happened inside the browser, helping analysts reach a verdict faster with evidence they can use to contain, escalate, or build detection logic.

⚡️ #ANYRUN Sandbox is the verification layer for cases that sit in the gray zone. See how SOC teams investigate phishing inside the browser: https://t.co/dq2BcXuSxm

[ANY.RUN @anyrun_app]

🚨 Greatness #PhaaS turns a fake Microsoft 365 login page into a potential BEC, data theft, and payment fraud incident.

👨‍💻 Learn how its branded lures, MFA bypass capabilities, and credential theft workflows put business identities at risk: https://t.co/r6venb6Drp

[ANY.RUN @anyrun_app]

Phishing activity in the past 7 days 🐟
Track latest #phishing threats in TI Lookup: https://t.co/LrZHmDvHHy

Here's what your SOC needs to know about rising #Sneaky2FA: https://t.co/CQ9uyWq5ls

#TopPhishingThreats

[ANY.RUN @anyrun_app]

⚡️ Reduce MTTD to 15 seconds per case in your SOC. Sign up now to detect comples malware & phishing threats early: https://t.co/x5bYm7E6Iy

[ANY.RUN @anyrun_app]

🎯 We added and updated 50 Suricata rules based on real attacker behavior observed in the wild. Explore the examples and strengthen your detection.

#ANYRUNSuricataChangelog 06/15 – 06/21/2026
Here are 10 examples 👇
89003944 | PHISHING [https://t.co/5F3kh2e7mb] Fake Google authorization page observed.
Example analysis session: [https://t.co/U95Mirt4fb]

89003945 | PHISHING [https://t.co/5F3kh2e7mb] Email exfiltration via HTTP Form.
Example analysis session: [https://t.co/mnxaykBiEK]

89003946 | PHISHING [https://t.co/5F3kh2e7mb] Password exfiltration via HTTP Form.
Example analysis session: [https://t.co/mnxaykBiEK]

89003949 | PHISHING [https://t.co/5F3kh2e7mb] Generic phishing URL observed (/api/store).
Example analysis session: [https://t.co/u3CJKuxXOt]

89003950 | PHISHING [https://t.co/5F3kh2e7mb] Generic phishing data exfiltrated via HTTP POST request (/api/send/).
Example analysis session: [https://t.co/u3CJKuxXOt]

89003951 | PHISHING [https://t.co/5F3kh2e7mb] Generic phishing URL observed (/api/bot).
Example analysis session: [https://t.co/DhWbH060Wk]

89003952 | PHISHING [https://t.co/5F3kh2e7mb] Microsoft Device Code Phishing related URL (/api/poll?device_code=).
Example analysis session: [https://t.co/qwgcRGn7K0]

89003953 | PHISHING [https://t.co/5F3kh2e7mb] Generic Phishing-kit related URL (/home/tokens.php).
Example analysis session: [https://t.co/pDF0OCALTE]

89003954 | PHISHING [https://t.co/5F3kh2e7mb] Generic Phishing-kit related URL (/home/nkjwf7283gbd2d2.php).
Example analysis session: [https://t.co/pDF0OCALTE]

84003485 | PHISHING [https://t.co/5F3kh2e7mb] M365-themed phishing campaign related URL (/interview?email=).
Example analysis session: [https://t.co/kpYoM6Y95F]

Explore the complete ruleset: https://t.co/U3BrsvejIk

[ANY.RUN @anyrun_app]

⚠️ Credential-focused malware remained highly active last week. #Vidar and #Stealc continued to grow, while #AsyncRAT maintained its lead and newer families like #SilentNet and #DonutLoader gained momentum.

📌 Trend to watch: attackers aren't relying on a single access path. Growth across stealers, RATs, and loaders suggests multiple stages of the intrusion chain are being scaled at the same time. For SOC teams, that increases the need to connect isolated signals before they become incidents.

Monitor the malware families driving today’s attacks: https://t.co/BB31YBdBW5

#Top10Malware

[ANY.RUN @anyrun_app]

❓ How often do your SOC reports drive action? We believe that a report should guide the next decision ⚡️

Our SOC-ready Tier 1 reports, generated automatically after every sandbox analysis, are structured for triage, escalation, and leadership reporting.

Curious how it works in your team. Share your perspective in the comments 💬

👨‍💻 See how SOC teams provide a decision-support layer with standardized Tier 1 reports: https://t.co/oNrboF5GDW

[ANY.RUN @anyrun_app]

🏆 #ANYRUN is the Best Security Investigation Platform 2026 by @TheHackersNews!

This award reflects our mission to help teams act with confidence and make daily security operations smoother 📈

See which SOC-focused improvements helped secure the award 👇
https://t.co/wRwSxeHc2f

[ANY.RUN @anyrun_app]

⚡ A single phishing page was used to build a YARA rule that uncovered 145 related samples.

With in-browser data inspection every URL carries pivot-ready evidence for hunting and detection.

🚀 See how full browser visibility transforms investigation: https://t.co/4EOoQrmMFY

[ANY.RUN @anyrun_app]

🔥 The Q1 2026 data reshaped what a strong security strategy looks like for CISOs.

One core principle: speed of understanding is a critical competitive advantage.

🎯 Get the strategic priorities where SOCs need to act faster than ever: https://t.co/0aR62TAHE3

[ANY.RUN @anyrun_app]

🚨 𝗪𝗵𝗮𝘁 𝗘𝘃𝗶𝗹𝗧𝗼𝗸𝗲𝗻𝘀 𝗛𝗶𝗱𝗲𝘀 𝗶𝗻 𝘁𝗵𝗲 𝗕𝗿𝗼𝘄𝘀𝗲𝗿: 𝗦𝗲𝗲 𝗕𝗲𝘆𝗼𝗻𝗱 𝗦𝘁𝗮𝘁𝗶𝗰 𝗨𝗥𝗟 𝗔𝗻𝗮𝗹𝘆𝘀𝗶𝘀
#EvilTokens remains one of the most active phishkits in our reports, abusing MS Device Code authentication to gain access through OAuth workflows rather than direct credential theft.

❗️ The landing page content is AES-GCM encrypted in the initial HTML response and becomes visible only after client-side decryption writes it into the browser DOM, making static URL analysis and network-only visibility incomplete.
👨‍💻 Review the full phishing flow: https://t.co/w5Q9GNw2gL

🚀 #ANYRUN sets a new standard for URL analysis, leaving no blind spots for phishing to exploit. In-browser data inspection shows exactly what happens inside the browser, exposing every phishing URL’s behavior.

⚡️ 𝗛𝗼𝘄 𝘁𝗼 𝘂𝘀𝗲 𝘁𝗵𝗲 𝗕𝗿𝗼𝘄𝘀𝗲𝗿 𝗗𝗮𝘁𝗮 𝘁𝗮𝗯 𝗶𝗻 #𝗔𝗡𝗬𝗥𝗨𝗡 𝗦𝗮𝗻𝗱𝗯𝗼𝘅 𝗳𝗼𝗿 𝗳𝘂𝗹𝗹 𝗨𝗥𝗟 𝘃𝗶𝘀𝗶𝗯𝗶𝗹𝗶𝘁𝘆 𝘁𝗵𝗮𝘁 𝘀𝗽𝗲𝗲𝗱𝘀 𝘂𝗽 𝘁𝗿𝗶𝗮𝗴𝗲 𝗮𝗻𝗱 𝗿𝗲𝘀𝗽𝗼𝗻𝘀𝗲:
𝗛𝗧𝗠𝗟 𝗗𝗢𝗠 𝗖𝗵𝗮𝗻𝗴𝗲𝘀: Track DOM states over time with timeshift, compare page states, and review byte-level diffs.
📌 In this case, it reveals when the decrypted phishing page is rendered, exposing the user code and other artifacts hidden in the initial response.

𝗨𝗥𝗟 𝗗𝗲𝘁𝗮𝗶𝗹𝘀: Review the final URL, domain, SSL certificate, DNS records, request statistics, and triggered signatures in one place.
📌 For device-code phishing, this helps quickly verify suspicious OAuth-related activity without manually correlating multiple data sources.

𝗛𝗧𝗧𝗣 𝗥𝗲𝗾𝘂𝗲𝘀𝘁𝘀: Inspect browser-level network activity across HTML, JS, Fetch/XHR, scripts, static files, binaries, archives, and other request categories.
📌 Here, requests to /api/device/start retrieve the userCode and sessionId, while /api/device/status/<sessionId> tracks authorization status, providing early confirmation of the phishing flow.

𝗜𝗻𝗱𝗶𝗰𝗮𝘁𝗼𝗿𝘀: Automatically collect page-level IOCs, including domains, URLs, hashes, IPs, and ASN data.
📌 These indicators provide immediate pivot points for threat hunting, helping analysts expand the investigation beyond the original URL.

✅ This turns URL triage from long manual reconstruction into a fast decision path: what loaded, what changed, and whether the case should be contained, escalated, or turned into detection logic.

When phishing relies on dynamic browser behavior, this visibility doesn't just speed up triage — it strengthens every downstream process: faster escalations, sharper response, stronger detection logic.

🚀 See how #ANYRUN closes phishing blind spots: https://t.co/CrYREaljzk
#ExploreWithANYRUN

[ANY.RUN @anyrun_app]

⚠️ Every delayed triage decision adds pressure to the SOC.

More manual checks, escalations, and time spent before real threats move into response.

⚡️ See how #ANYRUN helps teams validate threats faste and reduce operational risk 👇
https://t.co/fwcgeBaGCQ