🚨 We identified #Mir0Auth, a new phishkit targeting M365 auth tokens, with primary activity observed against US organizations. It starts with DocuSign-themed lures, then moves victims into Device Code phishing through source-code-like endpoints including /task_queue.cs, /context.go, and /window.rs, with XOR-obfuscated C2 URLs and request bodies. Review the flow and decoded network logic in #ANYRUN Sandbox: app.any.run/tasks/a1553640-c… Network chain, traffic obfuscation, and #IOCs below ⬇️ #ExploreWithANYRUN

🔥 We “hired” Lazarus APT remote workers — and uncovered their toolkit. @BirminghamCyber & @north_scan used #ANYRUN Sandbox to capture weeks of Famous Chollima activity inside a fake startup. 👀 How not to let a spy in? See full story and videos: any.run/cybersecurity-blog/l…

🔥 Q1 2026 Cyber Risk report by #ANYRUN is out! Explore the cyber risks and threat shifts for CISOs, including: ❗️ +14.7% credential theft ❗️ +98.3% loader attacks ❗️ +58.4% LOLBAS attacks Turn Q1 intel into Q2 security priorities. Get the report: any.run/cybersecurity-blog/c…

🚨 #Lazarus APT has weaponized new malware to hunt C-level credentials This campaign poses a direct financial and business risk, bypassing detection to steal executive data via fake meeting invites ❗️ Check @MauroEldritch's breakdown for defense steps 👇 any.run/cybersecurity-blog/l…

❗ macOS VM is now live ❗ 25K+ U.S. businesses already run on macOS. Yet #macOS threats remain a blind spot for many SOC teams. 👇 Close this gap now with a broader cross-platform threat visibility for faster and confident response! any.run/cybersecurity-blog/a…

🚨 #Phishing on Trusted Cloud Infrastructure: Google, Microsoft, Cloudflare. We’re tracking a growing trend where phishing kit infrastructure is hosted on legitimate cloud and CDN platforms, not newly registered domains. In some cases, these campaigns specifically target enterprise users. This creates serious visibility challenges for security teams. We’ve observed this pattern across multiple #phishkits: 🔹 #Tycoon hosted on alencure[.]blob[.]core[.]windows[.]net (Microsoft Azure Blob Storage): app.any.run/tasks/29b53d89-9… ⚠️ #Sneaky2FA hosted on legitimate cloud platforms, filtering out free email domains via a fake Microsoft 365 login to target corporate accounts: firebasestorage[.]googleapis[.]com (Cloud Storage for Firebase): app.any.run/tasks/8189dd5e-0… cloudfront[.]net (AWS CloudFront): app.any.run/tasks/9a2d1537-e… 🔹 #EvilProxy hosted on sites[.]google[.]com (Google Sites): app.any.run/tasks/07995c22-6… Victims see a “trusted” provider domain, while the network only sees normal HTML being loaded from cloud infrastructure. What looks clean at first glance is exposed by #ANYRUN Sandbox in under 60 seconds, directly reducing MTTD and MTTR. 🔍 Hunt for related activity and pivot from #IOCs using these search queries in TI Lookup: 🔹 Microsoft Azure Blob Storage abuse: intelligence.any.run/analysi… 🔹 Firebase Cloud Storage abuse: intelligence.any.run/analysi… 🔹 Google Sites abuse: intelligence.any.run/analysi… Many security vendors will flag these domains as legitimate. Technically, they are. That’s why security teams need behavioral analysis and network-level signals to reliably uncover phishing before impact. 🚀 Speed up detection and gain full visibility into complex threats with #ANYRUN. Sign up: app.any.run/?utm_source=twit… #ExploreWithANYRUN #IOCs: mphdvh[.]icu kamitore[.]com aircosspascual[.]com Lustefea[.]my[.]id

🔴 LIVE from inside #Lazarus APT's IT workers scheme. For weeks, @BirminghamCyber & @north_scan kept #hackers believing they controlled a US dev's laptop. In reality, it was our sandbox recording everything. See full story and videos ⬇️ any.run/cybersecurity-blog/l…

🎉 As #CyberSecurityAwareness Month comes to an end, we’re celebrating by sharing some of our awesome friends! 💡Follow them for insightful cyber tips and great analyses. Here’s the list, in no specific order: @James_inthe_box @M4lcode @RussianPanda9xx @BlueEye46572843 @JAMESWT_MHT @ericparker @akaclandestine @Ax_Sharma @petikvx @g0njxa @executemalware @kondah_ha @fr0gger_ @NicoKnowsTechYT @embee_research @RacWatchin8872 @lennyzeltser @Gi7w0rm @jstrosch @_JohnHammond @malwarelab_eu This list is just the beginning — feel free to drop your own cybersecurity profiles in the comments!