Company Blogs – Page 2 – BackBox.org News

SOC & Business Success with ANY.RUN: Real-World Results & Cases

January 29, 2026/in Company Blogs

Running a SOC today means constant trade-offs: too many alerts, not enough people, strict SLAs, and attacks that keep getting smarter. Most leaders aren’t asking for “the next cool product” but a proof that something actually cuts time, risk, and workload in real environments like theirs.

Thousands of organizations already rely on ANY.RUN to reduce analyst load, resolve phishing cases faster, cut unnecessary escalations, and speed up detection so incidents are contained before they reach the business.

Here we are bringing that evidence together. Let’s look at the results from different industries, how teams use ANY.RUN across Tier 1/2/3, and why it became a core part of their SOC operations, so if you’re still hesitating, you can see exactly what teams like yours are achieving with it.

What Real Teams Achieve with ANY.RUN: Proven Results Across Industries

When you look across banks, MSSPs, transport companies, and healthcare providers, the pattern is the same: once ANY.RUN becomes part of daily SOC operations, teams move faster, reduce noise, and prevent incidents earlier.

*Proven results achieved with ANY.RUN in various industries*

Here are the outcomes customers report consistently:

94% of users report faster phishing and malware triage in real SOC workflows.

76% faster phishing triage for a healthcare MSSP (from 30–40 minutes down to 4–7 minutes).

50%+ reduction in malware investigation and IOC extraction time.

Tier-1 closure rates rising from ~20% to around 70% after giving Tier 1 full behavioral evidence.

30–55% fewer false escalations thanks to richer context and verdict confidence.

21 minutes average MTTR reduction in SOCs that integrated ANY.RUN into their workflows.

15 seconds MTTD for phishing and malware threats which allows analysts to accelerate their SIEM/SOAR investigations.

Insights from ANY.RUN’s solutions helped SOC and MSSP teams stop hundreds of ransomware attempts before they ever touched production systems.

MSSP Success Case: Faster Threat Analysis Without Expanding the Team

Expertware is a European MSSP with over 18 years of experience, providing SOC services to organizations across banking, insurance, retail, telecom, and other industries. Their cyber intelligence operations team supports multiple customers at once, where speed and depth of analysis directly impact SLAs.

Challenge

Before adopting ANY.RUN’s Interactive Sandbox, malware investigations required manually building and maintaining reverse-engineering environments. This slowed response times, limited visibility into full attack chains, and made it harder to scale analysis across multiple customers without adding workload.

Outcome

Interactive sandbox boosting SOC performance — *Helping SOC teams to boost performance of Tier 1/2/3*

Expertware standardized a single analysis cycle centered on interactive execution and fast intelligence sharing:

Execute and observe: Suspicious files and phishing samples are detonated to expose full behavior and multi-stage chains.

Analyze in depth: Analysts interact with malware in real time to uncover obfuscation, memory-only stages, and C2 infrastructure.

Extract and share: Indicators and findings are mapped, documented, and shared across SOC and IR teams to speed decisions.

This approach removed the need for custom VMs and reduced friction across investigations.

Results

Over 50% reduction in malware investigation and IOC extraction time

Faster turnaround on customer incidents without increasing staff

Clear visibility into full kill chains, including fileless and memory-based stages

Easier collaboration through shared, interactive analysis reports

Improved SLA performance by resolving cases earlier in the workflow

Healthcare MSSP Success Case: Faster Phishing Triage Without SLA Risk

A mid-sized MSSP specializing in healthcare supports hospitals, clinics, and labs across thousands of endpoints. Operating in a highly regulated environment, the SOC had to balance strict SLAs, audit requirements, and a growing volume of phishing and malware alerts.

Challenge

As the customer base expanded, Tier 1 and Tier 2 teams were overwhelmed. Multi-stage phishing emails with redirects, QR codes, and CAPTCHA checks often took 30–40 minutes per case, driving escalations, slowing response, and putting SLA commitments at risk.

Outcome

TI Feeds for businesses — *TI Feeds giving wider threat coverage to companies*

The MSSP standardized a single operational triage cycle combining sandbox execution, threat intelligence, and detection feeds:

Early execution with the Interactive Sandbox cuts phishing triage by 76%, reducing analysis from 30–40 minutes to 4–7 minutes, while giving Tier 1 full visibility into real malware behavior.

Richer context through Threat Intelligence Lookup improves decision confidence, driving 34% fewer false escalations and enabling Tier 1 closure rates to rise from 20% to 70%.

Live intelligence via Threat Intelligence Feeds keeps detections current as attacker infrastructure rotates, resulting in faster MTTR and fewer false positives across automated workflows.

Continuous monitoring of active attacks affecting 15,000+ organizations enables early detection of the latest threats.

Results

Since we implemented new solutions, every investigation now comes with evidence and threat data, from MITRE tags to screenshots. This made reporting faster and extra work fell off our shoulders.

76% reduction in phishing triage time (from 30–40 minutes down to 4–7 minutes)

Higher Tier-1 closure rates with fewer escalations to Tier 2

Stronger SLA stability across multiple healthcare customers

Audit-ready investigations with clear execution evidence and context

A shift from reactive response to proactive, repeatable defense

Banking Success Case: Faster Analysis, Stronger Security Outcomes

A Brussels-based investment bank (750 employees) runs cybersecurity with a lean team of 12, where people often switch between threat analysis and incident response depending on what’s happening.

Challenge

When the Head of Cybersecurity joined, the security setup was “messier” than expected, and the team was getting swamped with alerts daily. Improving efficiency meant fixing the workflow, and a malware sandbox quickly became a top priority.

Outcome

The number of ransomware and credential stealing attempts we have prevented thanks to the sandbox is already in the hundreds.

After integrating ANY.RUN as part of a broader workflow overhaul, results showed up almost immediately. In the first week, the team was able to process alerts and threat analysis at least twice as fast, helping avoid incident response and recovery costs through timely actions.

Results

2× faster alert processing and threat analysis (visible in the first week)

Better understanding of malware behavior through VM control (browsing websites, downloading, executing files)

A faster, more practical approach than running custom-built VMs on isolated machines that take significant preparation

Prevented hundreds of ransomware and credential-stealing attempts over time

Stopped a supplier email attack by detonating the email, opening a password-protected ZIP, identifying a loader, and seeing it download and initiate ransomware in the VM, then blocking the email across the organization and warning other departments

Transport Company Success Case: Real-Time Visibility into Active Cyber Attacks

A multinational transport company operating across North America, Latin America, and Europe relies heavily on email to communicate with clients, contractors, and suppliers. With a 30-person security team, staying ahead of active attacks required a threat hunting approach that scaled without adding manual work.

Challenge

Attacker infrastructure changes rapidly, making static indicators and public reports outdated within days. Manually tracking phishing campaigns, malware activity, and CVEs relevant to the transport industry consumed time and made prioritization difficult.

Outcome

TI Lookup helping with triage and response — *TI Lookup helping companies with faster triage and response*

The team standardized a continuous threat hunting cycle that turns fresh execution data into detections:

Confirm reality with an interactive sandbox: Detonate suspicious samples to capture behavior and extract high-confidence artifacts.

Expand to campaign scope: Subscribe to TI Lookup’s Search Updates, pivot across related IOCs/IOAs/IOBs, domains, hosts, and historical activity.

Operationalize fast: Use TI Feeds to push validated indicators into existing security workflows so detections stay current.

Results

Near real-time visibility → faster decisions while attacks are still active.

Quicker IOC/IOA/IOB discovery → shorter time to contain relevant threats.

Less manual research → more capacity without extra headcount.

Clear active vs. expired prioritization → steadier SLAs, fewer wasted cycles.

Fresher detection updates → fewer repeat incidents as infrastructure rotates.

Trusted by Security Teams Worldwide

ANY.RUN is a part of daily security operations across industries where mistakes are expensive and downtime isn’t an option.

Today, organizations rely on ANY.RUN in real production environments across:

3,102 IT & technology companies

1,778 financial institutions

1,354 manufacturing organizations

919 healthcare providers

1,059 government entities

460 energy companies

347 transportation & logistics businesses

15k organizations using ANY.RUN — *The number of organizations relying on ANY.RUN to strengthen their security operations*

This trust shows up consistently in independent reviews:

4.7 / 5 on G2 — praised for speed, visibility, and day-to-day usability

4.8 / 5 on Gartner Peer Insights — recognized for real-world impact on SOC performance

G2 and Gartner reviews — *ANY.RUN reviews left by our users on G2 and Gartner*

This broad adoption across regulated, high-risk industries reinforces one thing:
ANY.RUN scales not just technically, but operationally; across teams, regions, and security maturity levels.

If teams in finance, healthcare, government, and critical infrastructure rely on it daily, it’s because it delivers results where stakes are highest.

Why These Results Repeat Across Teams and Industries

Infographic ANY.RUN — *The results companies get when using ANY.RUN in their security operations*

These outcomes show up in very different environments for one reason: high-performing teams don’t treat investigations as one-off incidents. They run a consistent, repeatable way of working that turns uncertainty into clarity fast and keeps that clarity flowing across the whole operation.

What makes the difference:

Decisions are based on evidence, not assumptions
Teams don’t wait for “maybe” signals to become obvious. They confirm what’s happening early, so risk doesn’t quietly grow in the background.

Context reaches the right people at the right moment
Frontline triage gets enough clarity to close routine cases confidently, while deeper work is reserved for what truly needs it.

Response stays steady even when attackers change tactics
As infrastructure rotates and methods evolve; teams don’t fall back into manual chase mode. They keep coverage current and avoid repeating the same work.

Workflows are built for scale, not heroics
The process holds up under load, across shifts, and across customers, which is why SLAs stabilize and burnout drops.

That’s why the same gains keep showing up: faster decisions, less noise, and fewer business-impacting incidents.

Ready to See What Results Like These Look Like in Your Environment?

Every SOC operates under different constraints; tools, team size, industry pressure, compliance rules. What doesn’t change is the cost of slow decisions, unnecessary escalations, and incidents that reach the business before they’re contained.

The teams featured here didn’t rebuild everything from scratch. They focused on shortening time-to-verdict, giving frontline staff better clarity, and keeping detection current as attacks evolved. The result was less noise, steadier SLAs, and fewer incidents turning into business problems.

If you’re weighing whether a change will actually move the needle, not in theory, but in daily operations, these results show what’s possible when security work becomes faster, clearer, and easier to scale.

See what faster decisions look like in practice, run your SOC with ANY.RUN.

About ANY.RUN

ANY.RUN is a core part of modern security operations, helping teams make faster, more confident decisions across Tier 1, Tier 2, and Tier 3. It fits into existing workflows without friction and strengthens the entire investigation lifecycle; from early validation to deeper analysis and ongoing threat awareness.

By revealing real attacker behavior, adding context where it’s missing, and keeping detections aligned with how threats actually evolve, ANY.RUN helps SOCs reduce noise, shorten response times, and limit business impact.

Today, more than 600,000 security specialists and 15,000 organizations worldwide rely on ANY.RUN to accelerate triage, cut unnecessary escalations, and stay ahead of phishing and malware campaigns that don’t stand still.

FAQ

What problem does ANY.RUN solve for modern SOC teams?

ANY.RUN helps SOC teams reduce alert overload, speed up investigations, and lower unnecessary escalations by providing real execution evidence of threats early in the workflow. This allows analysts to make faster, more confident decisions instead of relying on assumptions or incomplete signals.

How does ANY.RUN reduce phishing and malware triage time?

ANY.RUN reduces triage time by allowing analysts to safely execute suspicious files, links, and emails in an interactive sandbox and immediately observe real attacker behavior. Customers report up to a 76% reduction in phishing triage time and 50%+ faster malware investigations as a result.

What measurable SOC performance improvements do teams see with ANY.RUN?

Organizations using ANY.RUN consistently report:
– Faster phishing and malware triage (94% of users)
– 30–55% fewer false escalations
– Tier-1 closure rates increasing from ~20% to ~70%
– An average 21-minute MTTR reduction
– Earlier detection, with phishing MTTD as low as 15–20 seconds

How does ANY.RUN support Tier 1, Tier 2, and Tier 3 analysts?

ANY.RUN gives Tier 1 analysts enough behavioral evidence to confidently close routine cases, while Tier 2 and Tier 3 analysts can interact with malware in real time and enrich isolated artifacts with actionable intel to uncover obfuscation, memory-only stages, and full kill chains. This reduces bottlenecks and ensures work is handled at the right tier.

Can ANY.RUN improve SLA stability without increasing headcount?

Yes. Multiple MSSPs and enterprise SOCs report faster case resolution and steadier SLAs without hiring additional staff. By standardizing investigation workflows and reducing manual research, teams handle higher alert volumes with the same resources.

How does ANY.RUN help prevent incidents before they reach the business?

By confirming real threat in seconds and providing fresh intel as attacker infrastructure changes, ANY.RUN gives SOC teams actionable evidence for faster containment.

Which industries rely on ANY.RUN in real production environments?

ANY.RUN is used daily across high-risk and regulated industries, including finance, healthcare, government, manufacturing, energy, and transportation. More than 15,000 organizations worldwide rely on it to scale investigations, reduce noise, and improve SOC decision-making.

The post SOC & Business Success with ANY.RUN: Real-World Results & Cases appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – Read More

Love? Actually: Fake dating app used as lure in targeted spyware campaign in Pakistan

January 29, 2026/in Company Blogs

ESET researchers discover an Android spyware campaign targeting users in Pakistan via romance scam tactics, revealing links to a broader spy operation

WeLiveSecurity – Read More

Eeny, meeny, miny, moe? How ransomware operators choose victims

January 28, 2026/in Company Blogs

Most ransomware attacks are opportunistic, not targeted at a specific sector or region

Categories: Threat Research

Tags: Ransomware, cybercrime, state-sponsored ransomware, victimization

Sophos Blogs – Read More

Attackers Are Taking Over Real Email Threads to Deliver Phishing: New Enterprise Risk

January 28, 2026/in Company Blogs

Think you can trust every email that comes from a business partner?

Unfortunately, that’s no longer guaranteed; attackers now slip into legitimate threads and send messages that look fully authentic.

That’s exactly what happened in a new case uncovered by ANY.RUN researchers; a trust takeover inside a real executive discussion about a document awaiting final approval.

By detonating the suspicious message, the investigation exposed the full execution chain and linked it to a broader phishing campaign already active since 2025.

Let’s find out how this attack worked, and how your team can detect similar threats faster, safely, and without disrupting business processes.

TL;DR

Initial access: Likely compromise of a contractor mailbox already involved in the thread, enabling conversation hijacking inside a real C-suite approval flow.

Attack chain: SCA phishing email → 7x forwards → phishing link → Cloudflare Turnstile antibot page → Turnstile-protected phishing page → EvilProxy AiTM for Microsoft credential theft.

Evasion: Multi-step redirects + Turnstile mean the final phishing content is only exposed during real execution, not simple URL or static checks.

Detection: Behavioral detonation is required to see the full chain and confirm intent; static analysis alone is unlikely to flag it reliably.

Campaign context: Pivoting domains, URL paths (/bot, /robot), and patterns like loginmicrosoft* in TI Lookup maps this incident to a broader EvilProxy campaign, and supports hunting + detection engineering with both IOCs and IOBs.

New Phishing Attack Overview

This incident started as something that looked completely normal from the outside: a live email discussion about a document waiting for final approval. It didn’t contain any strange subject line or a cold intro. Just a reply that appeared to belong in the thread.

A phishing email sent from contractor’s sales manager account — *An email sent from contractor’s sales manager account, containing phishing link*

What made it dangerous was the access path. The attacker likely got into a supplier-side mailbox (a contractor’s sales manager account) and used that trusted identity to respond directly inside the active discussion among C-suite executives about a document pending final approval.

Initial access (suspected): Compromised contractor account that was already involved in business correspondence.

Delivery method: Conversation hijacking inside an existing C-suite thread.

Goal: Steal Microsoft credentials through a fake authentication page.

Protection evasion: Layered redirects and anti-bot gating designed to keep the content “clean” until a real user interacts.

Campaign link: Indicators connected to a broader operation consistent with the EvilProxy phishkit, active since early December 2025, with primary targeting in the Middle East.

Execution Chain Observed Step-by-Step

SCA phishing email → 7 forwarded messages → phishing link → anti-bot landing page (Cloudflare Turnstile) → phishing page (Cloudflare Turnstile) → EvilProxy

*Execution chain revealed by ANY.RUN researchers*

1) SCA phishing email (initial entry into the supply chain)

The campaign begins with a message designed to look like routine business communication from the supply chain side (contractor/vendor context). The goal at this stage is simple: land the first message in an inbox that’s already part of real business workflows, so later steps inherit trust.

2) 7 forwarded messages (conversation momentum + legitimacy)

The attacker didn’t need to write a convincing pitch. The thread did that work for them. As the email was forwarded across stakeholders, it picked up real context, real names, and the natural “we’re already discussing this” signal that makes people drop their guard. By the time it landed with executives, the link looked like just another step in a legitimate approval flow, not a new request that needed to be questioned.

An email sent by attackers using contractor’s account — *An email sent by attackers using contractor’s sales manager account*

3) Phishing link (the moment of action)

The link is placed where it looks expected: tied to “review,” “final approval,” or “document access.” It’s not framed as suspicious or urgent in a classic way.

*Attackers encouraging the potential victim to open the fake document*

4) Anti-bot landing page with Cloudflare Turnstile (filtering for real users)

After clicking, the victim doesn’t land on the phishing form immediately. First, they hit an intermediary page protected by Cloudflare Turnstile. This step helps the attackers in two ways:

It screens out automated scanners and some security crawlers.

It delays exposure of the real phishing content until a human completes the check.

*Security verification done inside ANY.RUN’s sandbox*

5) Phishing page with Cloudflare Turnstile (second gate before credential capture)

Once the user passes the first gate, they’re redirected to the phishing page; often with another Turnstile challenge. This extra layer reduces automated analysis success even more and increases the chance that the only “real” views of the credential page come from actual targets.

*The second Cloudflare verification before arriving to the phishing page*

6) EvilProxy (credential theft via adversary-in-the-middle)

After passing the gates, the user is presented with a fake Microsoft authentication flow that’s built to steal credentials in a way that works even when users have strong security habits. The intent is to capture what the attacker needs to access the account and continue the intrusion, often by expanding access to other threads, mailboxes, and internal resources.

*Social engineering attempt discovered by ANY.RUN sandbox*

Why Thread-Hijack Phishing is a Different Class of Business Risk

Supply chain phishing has changed. Modern campaigns run like full operations, built to blend into real workflows and scale quietly across vendors and partners. The biggest shift is simple: these attacks exploit business trust, not technical vulnerabilities.

What makes this wave different:

Layered social engineering: Targets are guided through multiple steps that feel normal in day-to-day work (review → approval → sign-in), so the “risk moment” gets buried inside routine actions.

Real conversation hijacking: Attackers reply inside an existing email thread, borrowing the credibility of a live discussion instead of trying to create it from scratch.

PhaaS-like infrastructure: Behind the scenes, the flow runs on multi-layer redirect chains, anti-bot gates, and rapidly changing domains; the kind of scale and setup that increasingly mirrors phishing-as-a-service platforms.

Low-noise, high-impact execution: Fewer messages, more credibility, and a shorter window for defenders to catch it before credentials are handed over.

How SOC Teams Can Spot and Confirm These Attacks Faster

Thread-hijack phishing is built to pass “quick checks.” The only reliable way to beat it is to run a repeatable cycle that moves from early signals → proof → context → action → prevention. With ANY.RUN, teams can validate suspicious activity safely, uncover full campaigns, and strengthen detections in minutes, instead of hours.

Here’s how to do it step-by-step:

1. Reveal the True Intent Behind Suspicious Links and Files

Once a thread-hijack email lands in someone’s inbox, the biggest mistake teams make is relying on quick checks. These attacks are built to look clean until the moment a real person interacts. That’s why the first step is always safe detonation.

Running the link or file in ANY.RUN’s controlled environment exposes the real behavior of the attack, redirects, anti-bot gates, phishing pages, injected scripts, even the steps that remain hidden from static scans. In most cases, the full flow becomes visible in under 60 seconds.

*Fake Microsoft login page discovered inside ANY.RUN’s sandbox in 60 seconds*

This is where teams get their first advantage:

94% report faster triage, because they are no longer guessing or waiting for confirmation.

The verdict becomes evidence-based, not subjective.

High-pressure approvals stop turning into high-risk blind spots.

Revealing intent early reduces workload for Tier-1 and prevents escalation loops that quietly drain SOC time and budget.

2. Investigate Deeper and Connect the Attack to the Bigger Picture

Modern supply chain phishing rarely comes as a one-off case. Behind a single malicious link usually hides an active campaign, a whole infrastructure layer, and hundreds of related samples circulating across industries.

The main advantage of ANY.RUN’s ecosystem is that a single sample is never isolated.
It lives inside a massive dataset enriched by 600,000+ analysts and telemetry from 15,000+ organizations.

This allows teams to immediately understand:

Which domains and URLs belong to the same actor

Whether similar attacks have been active in the past days or months

How the infrastructure evolves

Which TTPs define the campaign

Whether the activity ties back to known kits (like EvilProxy)

This transforms one incident into a campaign-level view; crucial for prioritization, threat hunting, and strategic response planning.

TI Lookup's associated sandbox sessions — *ANY.RUN’s TI Lookup displaying associated sandbox sessions for deeper investigation*

Use these TI Lookup search queries to find indicators and deeper campaign insights related to this phishing attack:

domainName:”^loginmicrosoft”

domainName:”bctcontractors.com$” OR domainName:”himsanam.com$”

url:”/bot/$” or url:”/robot/$”

This level of visibility supports business needs too: clear audit trails, stronger reporting for leadership, and transparent decision-making during incidents.

3. Stay Ahead of the Campaign with Fresh Threat Data Inside Your Existing Platform

Once you link the attack to a broader operation, the next step is staying ahead of it. Thread-hijack campaigns shift domains and redirect paths constantly, so teams need threat data that updates just as fast.

Fresh indicators extracted from ongoing detonation sessions by TI Feeds can flow directly into the tools your team already uses, SIEM, SOAR, email security, and detection pipelines.

*TI Feeds delivering fresh IOCs inside your existing platform*

This gives defenders the ability to:

See redirect and infrastructure changes early

Strengthen correlation rules with fresh, high-confidence IOCs

Validate threat-hunting ideas with real, recent telemetry

This ongoing flow transforms reactive detection into proactive monitoring, allowing teams to reduce the window between attack launch and discovery.

About ANY.RUN

ANY.RUN is a part of modern SOC workflows, easily integrating into existing processes and strengthening the entire operational cycle across Tier 1, Tier 2, and Tier 3.
It supports every stage of analysis; from exposing real behavior during detonation to enriching investigations with broader threat context and delivering continuous intelligence that helps teams move faster and make confident decisions.

Today, more than 600,000 specialists and 15,000 organizations rely on ANY.RUN to accelerate triage, reduce unnecessary escalations, and stay ahead of evolving phishing and malware campaigns.

The post Attackers Are Taking Over Real Email Threads to Deliver Phishing: New Enterprise Risk appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – Read More

The Week in Vulnerabilities: Cyble Urges Oracle, OpenStack Fixes

January 28, 2026/in Company Blogs

Cyble Vulnerability Intelligence researchers tracked 1,031 vulnerabilities in the last week, and nearly 200 already have a publicly available Proof-of-Concept (PoC), significantly increasing the likelihood of real-world attacks on those vulnerabilities.

A total of 72 vulnerabilities were rated as critical under the CVSS v3.1 scoring system, while 33 received a critical severity rating based on the newer CVSS v4.0 scoring system.

Below are some of the vulnerabilities flagged by Cyble threat intelligence researchers for prioritization by security teams in recent reports to clients.

The Week’s Top IT Vulnerabilities

CVE-2026-21969 is a 9.8-severity vulnerability in Oracle Agile Product Lifecycle Management for Process, specifically in the Supplier Portal component of Oracle Supply Chain. The flaw could enable unauthenticated remote attackers to achieve full system takeover via HTTP without needing credentials or user interaction.

CVE-2026-22797 is a 9.9-rated authentication bypass vulnerability in the OpenStack keystonemiddleware’s external_oauth2_token component. An authenticated attacker could escalate privileges or impersonate other users by sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id.

CVE-2026-0501 is a 9.9-severity SQL injection vulnerability in SAP S/4HANA Private Cloud and On-Premise, specifically the Financials General Ledger module, that could allow an authenticated attacker with low privileges to craft SQL queries, potentially enabling them to read sensitive financial data, modify records, or delete backend database content.

CVE-2026-22584 is an 8.5-rated code injection vulnerability in Salesforce’s Uni2TS library, affecting MacOS, Windows, and Linux systems, that could allow attackers to leverage executable code in non-executable files.

CVE-2025-69258 is a 9.8-rated unauthenticated remote code execution (RCE) vulnerability in Trend Micro Apex Central. The flaw could allow an unauthenticated, remote attacker to load an attacker-controlled DLL into a key executable, resulting in the execution of attacker-supplied code under the SYSTEM context on affected installations.

Among the vulnerabilities added to CISA’s Known Exploited Vulnerabilities (KEV) catalog were CVE-2024-37079, a 9.8-severity Broadcom VMware vCenter Server out-of-bounds write vulnerability, CVE-2026-21509, a 7.8-rated Microsoft Office Security Feature Bypass vulnerability, and CVE-2025-34026, a 9.2-rated Versa Concerto improper authentication vulnerability in the Traefik reverse proxy configuration that could potentially allow an attacker to access administrative endpoints.

Notable vulnerabilities discussed in open-source communities included CVE-2025-64155, a critical OS command injection vulnerability in Fortinet FortiSIEM, affecting Super and Worker nodes. An unauthenticated remote attacker could exploit the phMonitor service via crafted requests to execute arbitrary commands, potentially enabling full system compromise, including root access through file overwrites and privilege escalation. Cyble has also observed the vulnerability discussed by threat actors on dark web cybercrime forums.

Another vulnerability getting attention in open-source communities is CVE-2025-12420, dubbed ‘BodySnatcher’, a critical privilege escalation vulnerability in ServiceNow’s AI Platform, specifically involving the Virtual Agent API and Now Assist AI Agents. It could allow unauthenticated remote attackers to impersonate any ServiceNow user, including administrators, by leveraging a hardcoded authentication secret and email-based identity linking, leading to arbitrary actions, such as creating backdoor admin accounts.

Vulnerabilities Under Discussion on the Dark Web

In addition to CVE-2025-64155, Cyble dark web researchers observed threat actors discussing several other vulnerabilities on dark web and cybercrime forums. They include:

CVE-2026-23745, a high-severity directory traversal vulnerability in the node-tar library (versions ≤ 7.5.2) for Node.js. The vulnerability stems from improper sanitization of the linkpath in hardlink and symbolic link entries when preservePaths is set to false, which is the default secure behavior. An attacker could exploit this flaw by crafting malicious tar archives to bypass extraction root restrictions, achieving arbitrary file overwrite via hardlinks and symlink poisoning attacks. In CI/CD environments or automated pipelines, successful exploitation could result in remote code execution by overwriting configuration files, scripts, or binaries, though npm remains unaffected because it filters out Link and SymbolicLink tar entries.

CVE-2026-22812, a high-severity vulnerability in OpenCode, an open-source AI coding agent, affecting versions prior to 1.0.216. The flaw involves multiple weaknesses, including missing authentication for critical functions, exposed dangerous methods, and permissive cross-domain security policies. OpenCode automatically starts an unauthenticated HTTP server that allows any local process or any website via permissive CORS to execute arbitrary shell commands with the user’s privileges. After successful exploitation requiring user interaction, such as visiting a malicious website, attackers could gain complete compromise of confidentiality, integrity, and availability, with high impact across all three security dimensions.

A threat actor shared a high-severity exploit chain targeting Apple’s WebKit engine on iOS versions before iOS 26. The chain links CVE-2025-43529, a use-after-free flaw, with CVE-2025-14174, a memory corruption issue in the ANGLE Metal renderer. By delivering malicious web content, attackers first achieve code execution within the browser sandbox and then leverage the memory corruption to bypass platform security. Upon successful exploitation via a malicious webpage, attackers can install sophisticated spyware to monitor location, intercept messages, and access the device’s camera and microphone.

Conclusion

The number of vulnerabilities affecting high-profile enterprise environments highlights the constant pressure facing security teams, who must respond with rapid, well-targeted actions to patch the most critical vulnerabilities and successfully defend IT and critical infrastructure. A risk-based vulnerability management program should be at the heart of those defensive efforts.

Other cybersecurity best practices that can help guard against a wide range of threats include segmentation of critical assets; removing or protecting web-facing assets; Zero-Trust access principles; ransomware-resistant backups; hardened endpoints, infrastructure, and configurations; network, endpoint, and cloud monitoring; and well-rehearsed incident response plans.

Cyble’s comprehensive attack surface management solutions can help by scanning network and cloud assets for exposures and prioritizing fixes, in addition to monitoring for leaked credentials and other early warning signs of major cyberattacks.

The post The Week in Vulnerabilities: Cyble Urges Oracle, OpenStack Fixes appeared first on Cyble.

Cyble – Read More

Drowning in spam or scam emails? Here’s probably why

January 28, 2026/in Company Blogs

Has your inbox recently been deluged with unwanted and even outright malicious messages? Here are 10 possible reasons – and how to stem the tide.

WeLiveSecurity – Read More

Microsoft Office vulnerability (CVE-2026-21509) in active exploitation

January 27, 2026/in Company Blogs

Post Content

Sophos Blogs – Read More

Fake apps, NFC skimming attacks, and other Android issues in 2026 | Kaspersky official blog

January 27, 2026/in Company Blogs

The year 2025 saw a record-breaking number of attacks on Android devices. Scammers are currently riding a few major waves: the hype surrounding AI apps, the urge to bypass site blocks or age checks, the hunt for a bargain on a new smartphone, the ubiquity of mobile banking, and, of course, the popularity of NFC. Let’s break down the primary threats of 2025–2026, and figure out how to keep your Android device safe in this new landscape.

Sideloading

Malicious installation packages (APK files) have always been the Final Boss among Android threats, despite Google’s multi-year efforts to fortify the OS. By using sideloading — installing an app via an APK file instead of grabbing it from the official store — users can install pretty much anything, including straight-up malware. And neither the rollout of Google Play Protect, nor the various permission restrictions for shady apps have managed to put a dent in the scale of the problem.

According to preliminary data from Kaspersky for 2025, the number of detected Android threats grew almost by half. In the third quarter alone, detections jumped by 38% compared to the second. In certain niches, like Trojan bankers, the growth was even more aggressive. In Russia alone, the notorious Mamont banker attacked 36 times more users than it did the previous year, while globally this entire category saw a nearly fourfold increase.

Today, bad actors primarily distribute malware via messaging apps by sliding malicious files into DMs and group chats. The installation file usually sports an enticing name (think “party_pics.jpg.apk” or “clearance_sale_catalog.apk”), accompanied by a message “helpfully” explaining how to install the package while bypassing the OS restrictions and security warnings.

Once a new device is infected, the malware often spams itself to everyone in the victim’s contact list.

Search engine spam and email campaigns are also trending, luring users to sites that look exactly like an official app store. There, they’re prompted to download the “latest helpful app”, such as an AI assistant. In reality, instead of an installation from an official app store, the user ends up downloading an APK package. A prime example of these tactics is the ClayRat Android Trojan, which uses a mix of all these techniques to target Russian users. It spreads through groups and fake websites, blasts itself to the victim’s contacts via SMS, and then proceeds to steal the victim’s chat logs and call history; it even goes as far as snapping photos of the owner using the front-facing camera. In just three months, over 600 distinct ClayRat builds have surfaced.

The scale of the disaster is so massive that Google even announced an upcoming ban on distributing apps from unknown developers starting in 2026. However, after a couple of months of pushback from the dev community, the company pivoted to a softer approach: unsigned apps will likely only be installable via some kind of superuser mode. As a result, we can expect scammers to simply update their how-to guides with instructions on how to toggle that mode on.

Kaspersky for Android will help you protect yourself from counterfeit and trojanized APK files. Unfortunately, due to Google’s decision, our Android security apps are currently unavailable on Google Play. We’ve previously provided detailed information on how to install our Android apps with a 100% guarantee of authenticity.

NFC relay attacks

Once an Android device is compromised, hackers can skip the middleman to steal the victim’s money directly thanks to the massive popularity of mobile payments. In the third quarter of 2025 alone, over 44 000 of these attacks were detected in Russia alone — a 50% jump from the previous quarter.

There are two main scams currently in play: direct and reverse NFC exploits.

Direct NFC relay is when a scammer contacts the victim via a messaging app and convinces them to download an app — supposedly to “verify their identity” with their bank. If the victim bites and installs it, they’re asked to tap their physical bank card against the back of their phone and enter their PIN. And just like that the card data is handed over to the criminals, who can then drain the account or go on a shopping spree.

Reverse NFC relay is a more elaborate scheme. The scammer sends a malicious APK and convinces the victim to set this new app as their primary contactless payment method. The app generates an NFC signal that ATMs recognize as the scammer’s card. The victim is then talked into going to an ATM with their infected phone to deposit cash into a “secure account”. In reality, those funds go straight into the scammer’s pocket.

We break both of these methods down in detail in our post, NFC skimming attacks.

NFC is also being leveraged to cash out cards after their details have been siphoned off through phishing websites. In this scenario, attackers attempt to link the stolen card to a mobile wallet on their own smartphone — a scheme we covered extensively in NFC carders hide behind Apple Pay and Google Wallet.

The stir over VPNs

In many parts of the world, getting onto certain websites isn’t as simple as it used to be. Some sites are blocked by local internet regulators or ISPs via court orders; others require users to pass an age verification check by showing ID and personal info. In some cases, sites block users from specific countries entirely just to avoid the headache of complying with local laws. Users are constantly trying to bypass these restrictions —and they often end up paying for it with their data or cash.

Many popular tools for bypassing blocks — especially free ones — effectively spy on their users. A recent audit revealed that over 20 popular services with a combined total of more than 700 million downloads actively track user location. They also tend to use sketchy encryption at best, which essentially leaves all user data out in the open for third parties to intercept.

Moreover, according to Google data from November 2025, there was a sharp spike in cases where malicious apps are being disguised as legitimate VPN services to trick unsuspecting users.

The permissions that this category of apps actually requires are a perfect match for intercepting data and manipulating website traffic. It’s also much easier for scammers to convince a victim to grant administrative privileges to an app responsible for internet access than it is for, say, a game or a music player. We should expect this scheme to only grow in popularity.

Trojan in a box

Even cautious users can fall victim to an infection if they succumb to the urge to save some cash. Throughout 2025, cases were reported worldwide where devices were already carrying a Trojan the moment they were unboxed. Typically, these were either smartphones from obscure manufacturers or knock-offs of famous brands purchased on online marketplaces. But the threat wasn’t limited to just phones; TV boxes, tablets, smart TVs, and even digital photo frames were all found to be at risk.

It’s still not entirely clear whether the infection happens right on the factory floor or somewhere along the supply chain between the factory and the buyer’s doorstep, but the device is already infected before the first time it’s turned on. Usually, it’s a sophisticated piece of malware called Triada, first identified by Kaspersky analysts back in 2016. It’s capable of injecting itself into every running app to intercept information: stealing access tokens and passwords for popular messaging apps and social media, hijacking SMS messages (confirmation codes: ouch!), redirecting users to ad-heavy sites, and even running a proxy directly on the phone so attackers can browse the web using the victim’s identity.

Technically, the Trojan is embedded right into the smartphone’s firmware, and the only way to kill it is to reflash the device with a clean OS. Usually, once you dig into the system, you’ll find that the device has far less RAM or storage than advertised — meaning the firmware is literally lying to the owner to sell a cheap hardware config as something more premium.

Another common pre-installed menace is the BADBOX 2.0 botnet, which also pulls double duty as a proxy and an ad-fraud engine. This one specializes in TV boxes and similar hardware.

How to go on using Android without losing your mind

Despite the growing list of threats, you can still use your Android smartphone safely! You just have to stick to some strict mobile hygiene rules.

Install a comprehensive security solution on all your smartphones. We recommend Kaspersky for Android to protect against malware and phishing.
Avoid sideloading apps via APKs whenever you can use an app store instead. A known app store — even a smaller one — is always a better bet than a random APK from some random website. If you have no other choice, download APK files only from official company websites, and double-check the URL of the page you’re on. If you aren’t 100% sure what the official site is, don’t just rely on a search engine; check official business directories or at least Wikipedia to verify the correct address.
Read OS warnings carefully during installation. Don’t grant permissions if the requested rights or actions seem illogical or excessive for the app you’re installing.
Under no circumstances should you install apps from links or attachments in chats, emails, or similar communication channels.
Never tap your physical bank card against your phone. There is absolutely no legitimate scenario where doing this would be for your own benefit.
Do not enter your card’s PIN into any app on your phone. A PIN should only ever be requested by an ATM or a physical payment terminal.
When choosing a VPN, stick to paid ones from reputable companies.
Buy smartphones and other electronics from official retailers, and steer clear of brands you’ve never heard of. Remember: if a deal seems too good to be true, it almost certainly is.

Other major Android threats from 2025:

Pixnapping vulnerability: unblockable screenshots of your Android phone

Spyware that pretends to be an antivirus

Data theft during smartphone charging

SparkCat trojan stealer infiltrates App Store and Google Play, steals data from photos

Kaspersky official blog – Read More

Beyond MFA: Building true resilience against identity-based attacks

January 27, 2026/in Company Blogs

Categories: Sophos Insights

Tags: Identity Security, MFA, Sophos ITDR

Sophos Blogs – Read More

Аgentic AI security measures based on the OWASP ASI Top 10

January 27, 2026/in Company Blogs

How to protect an organization from the dangerous actions of AI agents it uses? This isn’t just a theoretical what-if anymore — considering the actual damage autonomous AI can do ranges from providing poor customer service to destroying corporate primary databases. It’s a question business leaders are currently hammering away at, and government agencies and security experts are racing to provide answers to.

For CIOs and CISOs, AI agents create a massive governance headache. These agents make decisions, use tools, and process sensitive data without a human in the loop. Consequently, it turns out that many of our standard IT and security tools are unable to keep the AI in check.

The non-profit OWASP Foundation has released a handy playbook on this very topic. Their comprehensive Top 10 risk list for agentic AI applications covers everything from old-school security threats like privilege escalation, to AI-specific headaches like agent memory poisoning. Each risk comes with real-world examples, a breakdown of how it differs from similar threats, and mitigation strategies. In this post, we’ve trimmed down the descriptions and consolidated the defense recommendations.

The top-10 risks of deploying autonomous AI agents. Source

Agent goal hijack (ASI01)

This risk involves manipulating an agent’s tasks or decision-making logic by exploiting the underlying model’s inability to tell the difference between legitimate instructions and external data. Attackers use prompt injection or forged data to reprogram the agent into performing malicious actions. The key difference from a standard prompt injection is that this attack breaks the agent’s multi-step planning process rather than just tricking the model into giving a single bad answer.

Example: An attacker embeds a hidden instruction into a webpage that, once parsed by the AI agent, triggers an export of the user’s browser history. A vulnerability of this very nature was showcased in a EchoLeak study.

Tool misuse and exploitation (ASI02)

This risk crops up when an agent — driven by ambiguous commands or malicious influence — uses the legitimate tools it has access to in unsafe or unintended ways. Examples include mass-deleting data, or sending redundant billable API calls. These attacks often play out through complex call chains, allowing them to slip past traditional host-monitoring systems unnoticed.

Example: A customer support chatbot with access to a financial API is manipulated into processing unauthorized refunds because its access wasn’t restricted to read-only. Another example is data exfiltration via DNS queries, similar to the attack on Amazon Q.

Identity and privilege abuse (ASI03)

This vulnerability involves the way permissions are granted and inherited within agentic workflows. Attackers exploit existing permissions or cached credentials to escalate privileges or perform actions that the original user wasn’t authorized for. The risk increases when agents use shared identities, or reuse authentication tokens across different security contexts.

Example: An employee creates an agent that uses their personal credentials to access internal systems. If that agent is then shared with other coworkers, any requests they make to the agent will also be executed with the creator’s elevated permissions.

Agentic Supply Chain Vulnerabilities (ASI04)

Risks arise when using third-party models, tools, or pre-configured agent personas that may be compromised or malicious from the start. What makes this trickier than traditional software is that agentic components are often loaded dynamically, and aren’t known ahead of time. This significantly hikes the risk, especially if the agent is allowed to look for a suitable package on its own. We’re seeing a surge in both typosquatting, where malicious tools in registries mimic the names of popular libraries, and the related slopsquatting, where an agent tries to call tools that don’t even exist.

Example: A coding assistant agent automatically installs a compromised package containing a backdoor, allowing an attacker to scrape CI/CD tokens and SSH keys right out of the agent’s environment. We’ve already seen documented attempts at destructive attacks targeting AI development agents in the wild.

Unexpected code execution / RCE (ASI05)

Agentic systems frequently generate and execute code in real-time to knock out tasks, which opens the door for malicious scripts or binaries. Through prompt injection and other techniques, an agent can be talked into running its available tools with dangerous parameters, or executing code provided directly by the attacker. This can escalate into a full container or host compromise, or a sandbox escape — at which point the attack becomes invisible to standard AI monitoring tools.

Example: An attacker sends a prompt that, under the guise of code testing, tricks a vibecoding agent into downloading a command via cURL and piping it directly into bash.

Memory and context poisoning (ASI06)

Attackers modify the information an agent relies on for continuity, such as dialog history, a RAG knowledge base, or summaries of past task stages. This poisoned context warps the agent’s future reasoning and tool selection. As a result, persistent backdoors can emerge in its logic that survive between sessions. Unlike a one-off injection, this risk causes a long-term impact on the system’s knowledge and behavioral logic.

Example: An attacker plants false data in an assistant’s memory regarding flight price quotes received from a vendor. Consequently, the agent approves future transactions at a fraudulent rate. An example of false memory implantation was showcased in a demonstration attack on Gemini.

Insecure inter-agent communication (ASI07)

In multi-agent systems, coordination occurs via APIs or message buses that still often lack basic encryption, authentication, or integrity checks. Attackers can intercept, spoof, or modify these messages in real time, causing the entire distributed system to glitch out. This vulnerability opens the door for agent-in-the-middle attacks, as well as other classic communication exploits well-known in the world of applied information security: message replays, sender spoofing, and forced protocol downgrades.

Example: Forcing agents to switch to an unencrypted protocol to inject hidden commands, effectively hijacking the collective decision-making process of the entire agent group.

Cascading failures (ASI08)

This risk describes how a single error — caused by hallucination, a prompt injection, or any other glitch — can ripple through and amplify across a chain of autonomous agents. Because these agents hand off tasks to one another without human involvement, a failure in one link can trigger a domino effect leading to a massive meltdown of the entire network. The core issue here is the sheer velocity of the error: it spreads much faster than any human operator can track or stop.

Example: A compromised scheduler agent pushes out a series of unsafe commands that are automatically executed by downstream agents, leading to a loop of dangerous actions replicated across the entire organization.

Human–agent trust exploitation (ASI09)

Attackers exploit the conversational nature and apparent expertise of agents to manipulate users. Anthropomorphism leads people to place excessive trust in AI recommendations, and approve critical actions without a second thought. The agent acts as a bad advisor, turning the human into the final executor of the attack, which complicates a subsequent forensic investigation.

Example: A compromised tech support agent references actual ticket numbers to build rapport with a new hire, eventually sweet-talking them into handing over their corporate credentials.

Rogue agents (ASI10)

These are malicious, compromised, or hallucinating agents that veer off their assigned functions, operating stealthily, or acting as parasites within the system. Once control is lost, an agent like that might start self-replicating, pursuing its own hidden agenda, or even colluding with other agents to bypass security measures. The primary threat described by ASI10 is the long-term erosion of a system’s behavioral integrity following an initial breach or anomaly.

Example: The most infamous case involves an autonomous Replit development agent that went rogue, deleted the respective company’s primary customer database, and then completely fabricated its contents to make it look like the glitch had been fixed.

Mitigating risks in agentic AI systems

While the probabilistic nature of LLM generation and the lack of separation between instructions and data channels make bulletproof security impossible, a rigorous set of controls — approximating a Zero Trust strategy — can significantly limit the damage when things go awry. Here are the most critical measures.

Enforce the principles of both least autonomy and least privilege. Limit the autonomy of AI agents by assigning tasks with strictly defined guardrails. Ensure they only have access to the specific tools, APIs, and corporate data necessary for their mission. Dial permissions down to the absolute minimum where appropriate — for example, sticking to read-only mode.

Use short-lived credentials. Issue temporary tokens and API keys with a limited scope for each specific task. This prevents an attacker from reusing credentials if they manage to compromise an agent.

Mandatory human-in-the-loop for critical operations. Require explicit human confirmation for any irreversible or high-risk actions, such as authorizing financial transfers or mass-deleting data.

Execution isolation and traffic control. Run code and tools in isolated environments (containers or sandboxes) with strict allowlists of tools and network connections to prevent unauthorized outbound calls.

Policy enforcement. Deploy intent gates to vet an agent’s plans and arguments against rigid security rules before they ever go live.

Input and output validation and sanitization. Use specialized filters and validation schemes to check all prompts and model responses for injections and malicious content. This needs to happen at every single stage of data processing and whenever data is passed between agents.

Continuous secure logging. Record every agent action and inter-agent message in immutable logs. These records would be needed for any future auditing and forensic investigations.

Behavioral monitoring and watchdog agents. Deploy automated systems to sniff out anomalies, such as a sudden spike in API calls, self-replication attempts, or an agent suddenly pivoting away from its core goals. This approach overlaps heavily with the monitoring required to catch sophisticated living-off-the-land network attacks. Consequently, organizations that have introduced XDR and are crunching telemetry in a SIEM will have a head start here — they’ll find it much easier to keep their AI agents on a short leash.

Supply chain control and SBOMs (software bills of materials). Only use vetted tools and models from trusted registries. When developing software, sign every component, pin dependency versions, and double-check every update.

Static and dynamic analysis of generated code. Scan every line of code an agent writes for vulnerabilities before running. Ban the use of dangerous functions like eval() completely. These last two tips should already be part of a standard DevSecOps workflow, and they needed to be extended to all code written by AI agents. Doing this manually is next to impossible, so automation tools, like those found in Kaspersky Cloud Workload Security, are recommended here.

Securing inter-agent communications. Ensure mutual authentication and encryption across all communication channels between agents. Use digital signatures to verify message integrity.

Kill switches. Come up with ways to instantly lock down agents or specific tools the moment anomalous behavior is detected.

Using UI for trust calibration. Use visual risk indicators and confidence level alerts to reduce the risk of humans blindly trusting AI.

User training. Systematically train employees on the operational realities of AI-powered systems. Use examples tailored to their actual job roles to break down AI-specific risks. Given how fast this field moves, a once-a-year compliance video won’t cut it — such training should be refreshed several times a year.

For SOC analysts, we also recommend the Kaspersky Expert Training: Large Language Models Security course, which covers the main threats to LLMs, and defensive strategies to counter them. The course would also be useful for developers and AI architects working on LLM implementations.

Kaspersky official blog – Read More