https://www.securityweek.com/malware-sandbox-any-run-targeted-in-phishing-attack/
##Infosec ##Security ##Cybersecurity ##CeptBiro ##Malware ##Sandbox ##AnyRun ##PhishingAttack
https://www.securityweek.com/malware-sandbox-any-run-targeted-in-phishing-attack/
##Infosec ##Security ##Cybersecurity ##CeptBiro ##Malware ##Sandbox ##AnyRun ##PhishingAttack
www.hudsonrock.com/threat-intel...
6. AbuseIPdb [ Comprobar IP ]
abuseipdb.com
7. Anyrun [ Reportes Ataques ]
app.any.run
8. BgpTools [ ASN / DNS ]
bgp.tools
9. Archiveorg [ Histórico Web ]
archive.org
www.hudsonrock.com/threat-intel...
6. AbuseIPdb [ Comprobar IP ]
abuseipdb.com
7. Anyrun [ Reportes Ataques ]
app.any.run
8. BgpTools [ ASN / DNS ]
bgp.tools
9. Archiveorg [ Histórico Web ]
archive.org
Introduction Security Operations Centers (SOCs) face increasing challenges in threat detection, investigation, and team collaboration. ANY.RUN offers a streamlined solution, integrating into existing infrastructure to accelerate incident…
Introduction Security Operations Centers (SOCs) face increasing challenges in threat detection, investigation, and team collaboration. ANY.RUN offers a streamlined solution, integrating into existing infrastructure to accelerate incident…
thehackernews.com/2024/09/expe...
#infosec #cybersecurity
thehackernews.com/2024/09/expe...
#infosec #cybersecurity
But none of them are quite there yet
But none of them are quite there yet
November's landscape was dominated by multi-stage loaders like XWorm and JSGuLdr delivering stealers and backdoors via in-memory execution.
-
IOCs: drive. google. com
-
#JSGuLdr #Malware #ThreatIntel #XWorm
November's landscape was dominated by multi-stage loaders like XWorm and JSGuLdr delivering stealers and backdoors via in-memory execution.
-
IOCs: drive. google. com
-
#JSGuLdr #Malware #ThreatIntel #XWorm
or I can give you the initial URL that create a tree of chain forwarding with other compromised sites. pdf files along the way also suspicious. 2/3
or I can give you the initial URL that create a tree of chain forwarding with other compromised sites. pdf files along the way also suspicious. 2/3
ClickFix is a deceptive social engineering tactic that tricks users into executing malicious commands disguised as bot verification tests, often through fake CAPTCHA prompts. Attackers manipulate victims into performing actions like…
ClickFix is a deceptive social engineering tactic that tricks users into executing malicious commands disguised as bot verification tests, often through fake CAPTCHA prompts. Attackers manipulate victims into performing actions like…
any.run/cybersecurit...
#Infosec #Security #Cybersecurity #CeptBiro #Crypto #Malware #ANYRUN
any.run/cybersecurit...
#Infosec #Security #Cybersecurity #CeptBiro #Crypto #Malware #ANYRUN
Introduction In today’s evolving threat landscape, organizations must adopt proactive cybersecurity measures to defend against malware, phishing, and automated attacks. Tools like ANY.RUN’s sandbox enable real-time…
Introduction In today’s evolving threat landscape, organizations must adopt proactive cybersecurity measures to defend against malware, phishing, and automated attacks. Tools like ANY.RUN’s sandbox enable real-time…
any.run/cybersecurit...
#Infosec #Security #Cybersecurity #CeptBiro #DCRat #ANYRUN
any.run/cybersecurit...
#Infosec #Security #Cybersecurity #CeptBiro #DCRat #ANYRUN
Using AnyRun, I was able to run this PERFECTLY NORMAL WeChat Installer:
0/69 VT score, Signed by "Commander Software Solutions Oy"
While running it, it required me to complete a captcha and also install .NET runtime.
1/2
Using AnyRun, I was able to run this PERFECTLY NORMAL WeChat Installer:
0/69 VT score, Signed by "Commander Software Solutions Oy"
While running it, it required me to complete a captcha and also install .NET runtime.
1/2
#411476 workflows/check-cherry-picks: fix silent failure
#411475 teams-for-linux: 2.0.13 -> 2.0.14
#411470 lib.maintainers.nicoo: update GH account name
#411455 anyrun: 0-unstable-2025-04-29 -> 0-unstable-2025-05-19
#411454 clorinde: 0.15.0 -> 0.15.1
#411476 workflows/check-cherry-picks: fix silent failure
#411475 teams-for-linux: 2.0.13 -> 2.0.14
#411470 lib.maintainers.nicoo: update GH account name
#411455 anyrun: 0-unstable-2025-04-29 -> 0-unstable-2025-05-19
#411454 clorinde: 0.15.0 -> 0.15.1
New 'Tykit' phishing kit uses SVG files and multi-stage redirects to steal Microsoft 365 corporate credentials.
-
IOCs: segy. zip, segy. xyz, segy2. cc
-
#Phishing #ThreatIntel #Tykit
New 'Tykit' phishing kit uses SVG files and multi-stage redirects to steal Microsoft 365 corporate credentials.
-
IOCs: segy. zip, segy. xyz, segy2. cc
-
#Phishing #ThreatIntel #Tykit
🌐 Bgp tools → bgp.tools
📚 Archive Org → archive.org
⚠️ BlackMail → blacklistchecker.com
🛠️ BuiltWithTech → builtwith.com
🌐 Bgp tools → bgp.tools
📚 Archive Org → archive.org
⚠️ BlackMail → blacklistchecker.com
🛠️ BuiltWithTech → builtwith.com
Attackers use GitHub, obfuscated JS, and BAT files to deliver Braodo Stealer, Remcos RAT, and NetSupport RAT.
-
IOCs: Braodo Stealer, Remcos RAT, NetSupport RAT
-
#Malware #RAT #ThreatIntel
Attackers use GitHub, obfuscated JS, and BAT files to deliver Braodo Stealer, Remcos RAT, and NetSupport RAT.
-
IOCs: Braodo Stealer, Remcos RAT, NetSupport RAT
-
#Malware #RAT #ThreatIntel
The Salty2FA phishing kit now uses Tycoon2FA as a fallback payload, creating a hybrid threat likely operated by the same group (Storm-1747).
-
IOCs: omvexe. shop, 1otyu7944x8. workers. dev, diogeneqc. pages. dev
-
...
The Salty2FA phishing kit now uses Tycoon2FA as a fallback payload, creating a hybrid threat likely operated by the same group (Storm-1747).
-
IOCs: omvexe. shop, 1otyu7944x8. workers. dev, diogeneqc. pages. dev
-
...