The smart-home craze has connected everything — from your lightbulbs to your tea kettle — to the internet, and the adult industry isn’t sitting this one out: manufacturers are releasing more smart models than ever. While syncing a sex toy to your smartphone unlocks some cool extra features, it also opens the door to potential security and privacy headaches. The good news? You can significantly lower most of these risks just by tweaking your settings and adjusting your usage habits.
How sex-toy apps actually work
To be clear upfront, while researchers have successfully hijacked sex toys in controlled experiments, the odds of a hacker remotely taking over your vibrator in the real world are pretty slim. In this post, we focus on the more realistic risks: your privacy and the safety of your data.
Most modern adult toys link up with the manufacturer’s app. These apps offer a range of usage options: you can control the device yourself, or hand over the remote to a partner — anywhere in the world via the internet.
Beyond just basic controls, many of these apps have social features: private messaging, group chats, calls, and even video sessions. In fact, you don’t even need a physical device to use some of them; you just create an account. Because of this, some of these services have essentially evolved into niche dating platforms.
The toy and your phone talk to each other via Bluetooth — with minimal risks. To handle social features or remote control, the app connects to a cloud server. This creates a constant stream of data moving back and forth: everything from commands to private messages.
Here’s the catch: even if you only use the app to control your toy locally via Bluetooth, you still get connected to that cloud server. That means you’re inheriting all the security and privacy risks.
The main risks of using sex-toy apps
Sex-toy apps are typically free. In practice, this means the primary way these services make money is by collecting data — which is often excessive. It’s not hard to find buyers of this information; it could be ad services, data brokers, or other companies interested in building detailed user profiles.
Developers of intimate apps suffer from frequent data breaches, and in this sense they’re no different from many other online services that spring a leak regularly. However, unlike a breach at an online pet food store, a data leak from a sex toy app can have much more serious consequences for the user. For sex industry workers, such as those who use webcams, these data breaches pose a direct threat to their physical safety.
Vulnerabilities within the service’s infrastructure warrant special attention. These types of bugs can be exploited by hackers to gain unauthorized access to other people’s accounts.
The inclusion of broad social features essentially turns sex-toy apps into just another messaging platform. However, while we usually know if mainstream messengers use end-to-end encryption, or what vulnerabilities they face, every sex-toy app has to be evaluated individually.
Without end-to-end encryption, user chats may be accessible on the server side. This means that if the service is compromised, the contents of those messages could end up in the hands of hackers. Furthermore, the sex toy manufacturer itself, or its individual employees, could have access to your chats.
Finally, the user’s account and everything in it can be hijacked by bad actors if it isn’t protected by a strong password and, ideally, two-factor authentication.
How to lower the risks when using sex-toy apps
Now that we’ve covered the threats, let’s talk about how to defend yourself. The most obvious choice is to skip installing the app altogether. Thankfully, most sex toys still come with physical buttons — unlike, say, smart mattresses, which often require an app just to function. For those who want the extra features, here are some practical tips for setting up and using these services.
Create an account with a dedicated email address
Set up a separate email address just for registering your account in the intimate app. This should be a “clean” email with no links to any other online services you use. Naturally, the username for this email account shouldn’t include your real name or any other easily identifiable info.
Using an anonymous email protects your reputation if the app suffers a data breach. The risk of this happening is far from theoretical. For instance, back in 2015, a hacking group named The Impact Team leaked the user database of Ashley Madison, a dating site for people seeking extramarital affairs.
To create an anonymous email, pick a service that doesn’t require a phone number at all, or lets you skip that step. Besides your real name, we also recommend leaving out your birth date, your usual social media handles, and any other details that could lead back to you.
Don’t sign up via Google, Apple, social media, or your phone number
The reasoning here is basically the same as the previous point. However, it’s worth highlighting that signing up through Google, Apple, social media, or your phone number is actually just about the worst way to go.
Using Google or social media accounts gives the app permission to, among other things, access certain data from those profiles. In the context of intimate apps, this is especially risky because it creates a direct link between highly sensitive data and your real-world identity.
Keep your real info out of your profile
Once you’re in the app, don’t use any information that could be traced back to you. Come up with an anonymous handle (if you’re feeling uninspired, use a random nickname generator), pick a fake birthday, and choose a random location.
Using fictional info means you don’t have to sweat being outed if the service ever leaks your data. You’re also protecting yourself from stalking, blackmail, and other threats that come with someone being able to pin your real identity to your account.
Hide your face and distinguishing marks when sharing private media
As we’ve mentioned throughout this post, these apps often include social features used for swapping intimate photos and videos. Even if you trust the person you’re chatting with, those files can be saved, forwarded, or used without your consent. When combined with other account info, they can make it easy to figure out who you are.
We recommend never sending intimate media that shows your face or anything else that identifies you — think recognizable home decor, personal items, documents, unique clothing, tattoos, or jewelry.
Set a strong password and enable two-factor authentication, if available
If a hacker breaks into your sex toy account, they’re getting access to your most private data. Because of that, your account needs a rock-solid password. Just to be clear, here’s what we mean by a strong password:
It’s at least 16 characters long.
It uses a mix of uppercase and lowercase letters, numbers, and special characters (like $ or @).
It’s not a real word or a well-known phrase.
It’s unique and not reused for any of your other accounts.
It doesn’t include personal info that’s easy for an outsider to find.
We also recommend turning on two-factor authentication (2FA) if the service offers it. Your best bet is to use 2FA one-time codes from an authenticator app, as it’s the most secure and completely anonymous option. You can dive deeper into creating and storing secure passwords, as well as different 2FA methods, in our dedicated blogposts.
Grant only the necessary app permissions
Every mobile app asks for permission to access certain features of your phone like Bluetooth, location, your camera, or your storage. Every extra “yes” you give expands the amount of data the app can scoop up.
We suggest being extra cautious about what you let these services see, especially when it comes to sex-toy apps. By tightening these permissions, you cut down on the amount of info that can be collected or shared without your say-so.
Take a second to think about the absolute bare minimum you’re willing to allow a sex-toy app to access. For example, there’s usually no reason for it to track your location or access your camera and mic. If you do want to upload photos, it’s better to grant access only to specific files rather than giving the app the keys to your entire photo library.
Stop apps from tracking your activity
In your iOS settings, you can block apps from collecting data about what you do and linking it to a single advertising ID. This practice, known as tracking, allows companies to stitch together data from different apps, websites, and services to build a comprehensive profile of you for targeted ads or behavioral analysis.
We strongly recommend disabling tracking for all sex-toy apps so that sensitive details about your private life don’t end up as part of your advertising profile.
Unfortunately, Android doesn’t have an exact equivalent for this setting. To minimize data collection on those devices, you’ll need to turn off ad personalization, and manually delete or reset your advertising ID every now and then. You can find more tips on dodging ad tracking in our dedicated guide.
Keep your apps and operating system up to date
Updates aren’t just about shiny new features; they also fix security bugs. Outdated versions of apps and operating systems often have vulnerabilities that hackers are just waiting to exploit.
Staying on top of your updates helps close these gaps, and lowers the risk of data breaches or unauthorized access. To make sure you don’t miss any critical fixes, it’s best to turn on automatic updates whenever possible.
Security is in your hands
Smart sex-toys and their companion apps naturally handle sensitive data, which means they require extra care when it comes to setup and daily use. That said, you can eliminate — or at least significantly reduce — most risks by following basic security rules. Essentially, it comes down to sharing as little personal info as possible with the app and, of course, using a rock-solid password.
Want more tips on keeping your intimate life private in the digital age? Check out these posts:
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-04-13 11:06:382026-04-13 11:06:38How to protect your privacy while using smart sex toys | Kaspersky official blog
If you’ve been the victim of fraud, you’re likely already a lead on a ‘sucker list’ – and if you’re not careful, your ordeal may be about to get worse.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-04-11 05:06:282026-04-11 05:06:28Recovery scammers hit you when you’re down: Here’s how to avoid a second strike
At the NDSS Symposium 2026 in San Diego in February, a group of respected researchers presented a study unveiling the AirSnitch attack, which bypasses the Wi-Fi client isolation feature — also commonly known as guest network or device isolation. This attack allows connecting to a single wireless network via an access point, and then gaining access to other connected devices, including those using entirely different service set identifiers (SSIDs) on that same hardware. Targeted devices could easily be running on wireless subnets protected by WPA2 or WPA3 protocols. The attack doesn’t actually break encryption; instead, it exploits the way access points handle group keys and packet routing.
In practical terms, this means that a guest network provides very little in the way of real security. If your guest and employee networks are running on the same physical device, AirSnitch allows a connected attacker to inject malicious traffic into neighboring SSIDs. In some cases, they can even pull off a full-blown man-in-the-middle (MitM) attack.
Wi-Fi security and the role of isolation
Wi-Fi security is constantly evolving; every time a practical attack is made against the latest generation of protection, the industry shifts toward more complex algorithms and procedures. This cycle started with the FMS attacks used to crack WEP encryption keys, and continues to this day: recent examples include the KRACK attacks on WPA2, and the FragAttacks, which impacted every security protocol version from WEP all the way through WPA3.
Attacking modern Wi-Fi networks effectively (and quietly) is no small feat. Most professionals agree that using WPA2/WPA3 with complex keys and separating networks based on their purpose is usually enough for protection. However, only specialists really know that client isolation was never actually standardized within the IEEE 802.11 protocols. Different manufacturers implement isolation in completely different ways — using Layer 2 or Layer 3 of network architecture; in other words, handling it at either the router or the Wi-Fi controller level — meaning the behavior of isolated subnets varies wildly depending on your specific access point or router model.
While marketing claims that client isolation is perfect for keeping restaurant or hotel guests from attacking one another — or ensuring corporate visitors can’t access anything but the internet — in reality, isolation often relies on people not trying to hack it. This is exactly what the AirSnitch research highlights.
Types of AirSnitch attacks
The name AirSnitch doesn’t just refer to a single vulnerability, but a whole family of architectural flaws found in Wi-Fi access points. It’s also the name of an open-source tool used to test routers for these specific weaknesses. However, security professionals need to keep in mind that there’s only a very thin line between testing and attacking.
The model for all these attacks is the same: a malicious client is connected to an access point (AP) where isolation is active. Other users — the targets — are connected to the same SSID or even different SSIDs on that same AP. This is a very realistic scenario; for example, a guest network might be open and unencrypted, or an attacker could simply get the guest Wi-Fi password by posing as a legitimate visitor.
For certain AirSnitch attacks, the attacker needs to know the victim’s MAC or IP address beforehand. Ultimately, how effective each attack is depends on the specific hardware manufacturer (more on that below).
GTK attack
After the WPA2/WPA3 handshake, the access point and the clients agree on a Group Transient Key (GTK) to handle broadcast traffic. In this scenario, the attacker wraps packets destined for a specific victim inside a broadcast traffic envelope. They then send these directly to the victim while spoofing the access point’s MAC address. This attack only allows for traffic injection, meaning the attacker won’t receive a response. However, even that is enough to deliver malicious ICMPv6 routing advertisements, or DNS and ARP messages to the client — effectively bypassing isolation. This is the most universal version of the attack working on any WPA2/WPA3 network that uses a shared GTK. That said, some enterprise-grade access points support GTK randomization for each individual client, which renders this specific method ineffective.
Broadcast packet redirection
This version of the attack doesn’t even require the attacker to authenticate at the access point first. The attacker sends packets to the AP with a broadcast destination address (FF:FF:FF:FF:FF:FF) and the ToDS flag set to 1. As a result, many access points treat this packet as legitimate broadcast traffic; they encrypt it using the GTK, and blast it out to every client on the subnet, including the victim. Just like in the previous method, traffic specifically meant for a single victim can be pre-packaged inside.
Router redirection
This attack exploits an architectural gap between Layer 2 and Layer 3 security found in some manufacturers’ hardware. The attacker sends a packet to the access point, setting the victim’s IP address as the destination at the network layer (L3). However, at the wireless layer (L2), the destination is set to the access point’s own MAC address, so the isolation filter doesn’t trip. The routing subsystem (L3) then dutifully routes the packet back out to the victim, bypassing the L2 isolation entirely. Like the previous methods, this is another transmit-only attack where the attacker can’t see the reply.
Port stealing to intercept packets
The attacker connects to the network using a spoofed version of the victim’s MAC address, and floods the network with ARP responses claiming, “this MAC address is on my port and SSID”. The target network’s router updates its MAC tables, and starts sending the victim’s traffic to this new port instead. Consequently, traffic intended for the victim ends up with the attacker — even if the victim is connected to a completely different SSID.
In a scenario where the attacker connects via an open, unencrypted network, this means traffic meant for a client on a WPA2/WPA3-secured network is actually broadcast over the open air, where not only the attacker but anyone nearby can sniff it.
Port stealing to send packets
In this version, the attacker connects directly to the victim’s Wi-Fi adapter, and bombards it with ARP requests spoofing the access point’s MAC address. As a result, the victim’s computer starts sending its outgoing traffic to the attacker instead of the network. By running both stealing attacks simultaneously, an attacker can, in several scenarios, execute a full MitM attack.
Practical consequences of AirSnitch attacks
By combining several of the techniques described above, a hacker can pull off some pretty serious moves:
Complete bidirectional traffic interception for a MitM attack. This means they can snatch and modify data moving between the victim and the access point without the victim ever knowing.
Hopping between SSIDs. An attacker sitting on a guest network can reach hosts on a locked-down corporate network if both are running off the same physical access point.
Attacks on RADIUS. Since many companies use RADIUS authentication for their corporate Wi-Fi, an attacker can spoof the access point’s MAC address to intercept initial RADIUS authentication packets. From there, they can brute-force the shared secret. Once they have that, they can spin up a rogue RADIUS server and access point to hijack data from any device that connects to it.
Exposing unencrypted data from “secure” subnets: Traffic that’s supposed to be sent to a client under the protection of WPA2/WPA3 can be retransmitted onto an open guest network, where it’s essentially broadcast for anyone to hear.
To pull off these attacks effectively, a hacker needs a device capable of simultaneous data transmission and reception with both the victim’s adapter and the access point. In a real-world scenario, this usually means a laptop with two Wi-Fi adapters running specifically configured Linux drivers. It’s worth noting that the attack isn’t exactly silent: it requires a flood of ARP packets, it can cause brief Wi-Fi glitches when it starts, and network speeds might tank to around 10Mbps. Despite these red flags, it’s still very much a practical threat in many environments.
Vulnerable devices
As part of the study, several enterprise and home access points and routers were put to the test. The list included products from Cisco, Netgear, Ubiquiti, Tenda, D-Link, TP-Link, LANCOM, and ASUS, as well as routers running popular community firmware like DD-WRT and OpenWrt. Every single device tested was vulnerable to at least some of the attacks described here. Even more concerning, the D-Link DIR-3040 and LANCOM LX-6500 were susceptible to every single variation of AirSnitch.
Interestingly, some routers were equipped with protective mechanisms that blocked the attacks, even though the underlying architectural flaws were still present. For example, the Tenda RX2 Pro automatically disconnects any client whose MAC address appears on two BSSIDs simultaneously, which effectively shuts down port stealing.
The researchers emphasize that any network administrator or IT security team serious about defense should test their own specific configurations. That’s the only way to pinpoint exactly which threats are relevant to your organization’s setup.
How to protect your corporate network from AirSnitch
The threat is most immediate for organizations running guest and corporate Wi-Fi networks on the same access points without additional VLAN segmentation. There are also significant risks for companies using RADIUS with outdated settings or weak shared secrets for wireless authentication.
The bottom line is that we need to stop viewing client isolation on an access point as a real security measure, and start seeing it as just a convenience feature. Real security needs to be handled differently:
Segment the network using VLANs. Each SSID should have its own VLAN, with strict 802.1Q packet tagging maintained all the way from the access point to the firewall or router.
Implement stricter packet inspection at the routing level — depending on the hardware capabilities. Features like Dynamic ARP Inspection, DHCP snooping, and limiting the number of MAC addresses per port help defend against IP/MAC spoofing.
Enable individual GTK keys for each client, if your equipment supports it.
Use more resilient RADIUS and 802.1X settings, including modern cipher suites and robust shared secrets.
Log and analyze EAP/RADIUS authentication anomalies in your SIEM. This helps track many attack attempts beyond just AirSnitch. Other red flag events to watch for include the same MAC address appearing on different SSIDs, spikes in ARP requests, or clients rapidly jumping between BSSIDs or VLANs.
Apply security at higher levels of the network topology. Many of these attacks lose their punch if the organization has universally implemented TLS and HSTS for all business application traffic, requires an active VPN for all Wi-Fi connections, or has fully embraced a Zero Trust architecture.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-04-10 18:06:372026-04-10 18:06:37How to protect your organization from AirSnitch Wi-Fi vulnerabilities | Kaspersky official blog
One of the clearest trends in the 2025 Talos Year in Review is just how quickly vulnerabilities are now being turned into working exploits. What used to take weeks or months is now happening in days, sometimes hours — and in some cases, exploitation is beginning almost immediately after vulnerability details are made public.
The process of exploitation itself is changing. With the increasing availability of proof-of-concept code, automation, and AI-assisted tooling, certain vulnerabilities can very quickly become weaponized, which is what we saw with React2Shell.
At the same time, the data shows that attackers are not just chasing new vulnerabilities. They are consistently targeting what is exposed, accessible, and valuable.
On one end of the spectrum, near-instant exploitation. On the other, long-standing vulnerabilities that remain unaddressed.
Attackers are using a combination of speed, scale, and accessibility to reduce the window defenders have to respond, while increasing the impact when they can’t.
In the latest episode of the Talos Threat Perspective, we explore what the ‘industrialization of exploitation’ looks like in practice, and what it means for defenders trying to prioritise risk in an increasingly compressed timeline.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-04-10 16:06:342026-04-10 16:06:34[Video] The TTP Ep. 22: The Collapse of the Patch Window
Welcome to this week’s edition of the Threat Source newsletter.
“Study hard what interests you the most in the most undisciplined, irreverent and original manner possible.” ― Richard Feynman
“I had discovered that learning something, no matter how complex, wasn’t hard when I had a reason to want to know it.” ― Homer Hickam, Rocket Boys
*looks around at – gestures – everything*
*opens a new tab in the browser, takes in the newest news on AI, a new tab on supply chains, a new tab on vulnerability, and a new tab on active exploitation and zero-days*
*closes tabs and throws laptop into the nearest bin, à la Ron Swanson*
*opens other laptop, avoids the internet*
*puts on headphones for deep work binaural audio*
*cracks knuckles*
I’m often asked about why I bring up board games and video games when interviewing perspective analysts or threat hunters, so I’m going to give the 8,000 foot view on my thoughts. With everything that is going on, now more than ever we need the most curious people on the planet on our side.
What’s the very first and most important step to securing any environment? Knowing the environment, inside and out. When you play any gameyou must understand the rules: the standard opening moves of chess, or Go, or perhaps the common resource-gathering patterns in strategy games. Once you understand what “normal” play looks like, you can immediately spot when an opponent makes a move that is inefficient or unusual — an anomalous trigger that, if spotted, can lead to victory.
When experienced players recognize patterns (a specific chess gambit, a defensive build in a strategy game, etc.), they don’t just react to the current move — they predict several moves into the future from both players, especially if they know their opponents’ tendencies. As players gain experience and play against other skilled players, they begin involving feints or decoys (false flags, if you will). A player might sacrifice a minor piece to distract you from their true objective. Learning to look past that “noise” to find the real motivation is the key to taking your experience and skill to the next level.
Threat actors rarely follow a predictable script. They constantly evolve tactics, techniques, and procedures (TTPs). Developing the mental flexibility to handle those unexpected, non-standard behaviors is essential in identifying the unknowns.
The transition from board games to threat hunting is rooted in the development of critical thinking and situational awareness. While board games provide a controlled environment to practice these skills, the core competency — that ability to identify the why behind a deviation — is exactly what will make you a successful threat hunter.
“I prefer to speak in metaphor: That way, no logic can trap me, and no rule can bind me, and no fact can limit me or decide for me what’s possible.” ― Claire Oshetsky, Chouette
The one big thing
Cisco Talos has observed threat actors weaponizing legitimate SaaS notification pipelines, such as those in GitHub and Jira, to deliver phishing and spam emails. By leveragingthese platforms’ official infrastructure, attackers bypass traditional email authentication protocols like SPF, DKIM, and DMARC. This “Platform-as-a-Proxy” (PaaP) technique exploits the implicit trust organizations place in system-generated notifications to facilitate credential harvesting. These campaigns effectively mask malicious intent behind the reputation of trusted enterprise tools.
Why do I care?
Traditional email security gateways are often blind to these attacks because the emails are technically authenticated and originate from verified, trusted domains. This technique exploits “automation fatigue,” where users are conditioned to reflexively trust system-generated alerts from business-critical platforms. Consequently, attackers can bypass standard perimeter defenses, making it harder to distinguish between legitimate business communications and sophisticated phishing attempts.
So now what?
Transition to a Zero-Trust approach by implementing instance-level verification and cross-referencing notifications against internal SaaS directories. Security teams should ingest SaaS API logs into their SIEM to detect anomalous precursor activities, such as suspicious project creation or mass invitations. Additionally, introduce friction for high-risk interactions by requiring out-of-band verification and apply semantic intent analysis to identify notifications that deviate from a platform’s established functional baseline.
Top security headlines of the week
Tech giants launch AI-powered “ProjectGlasswing” Major technology companies have joined forces in an effort to use advanced artificial intelligence to identify and address security flaws in the world’s most critical software systems. (CyberScoop)
Russian government hackers broke into thousands of home routers to steal passwords Fancy Bear, or APT 28, is known for its high-profile hacks and spying operations, including the breach of the U.S. Democratic National Committee in 2016 and the destructive hack that hit satellite provider Viasat in 2022. (TechCrunch)
Storm-1175 deploys Medusa ransomware at “high velocity” Storm-1175 has rapidly exploited more than a dozen n-days, the most recent of which is CVE-2026-1731, a critical remote code execution flaw in BeyondTrust Remote Support and older versions of the vendor’s Privileged Remote Access. (Dark Reading)
North Korean hackers poseastrading firm to steal $285M from Drift A group of individuals approached Drift staff at a “major crypto conference,” presenting as a professional quantitative trading firm. They went so far as to deposit $1M of their own money into a Drift Ecosystem Vault between December 2025 and January 2026. (HackRead)
Telehealth giant Hims & Hers says its customer support system was hacked A spokesperson for Hims & Hers said the company was hit by a social engineering attack, and the stolen data “primarily included customer names and email addresses.” (TechCrunch)
Can’t get enough Talos?
New Lua-based malwareobservedin targeted attacks against Taiwanese organizations Cisco Talos uncovered a cluster of activity we track as UAT-10362 conducting spear-phishing campaigns against Taiwanese non-governmental organizations (NGOs) and suspected universities to deliver a newly identified malware family, “LucidRook.”
Vulnerabilities old and new and something React2 2025 was characterized by an unending beat-down on infrastructure that relied on older enmeshed dependencies (e.g., Log4j and PHPUnit), while React2Shell rocketed to the highest percentage of attacks for the entire year within the last three weeks of the year.
From the field to the report and back again The same Year in Review report that Talos IR casework feeds into is the report that defenders should be feeding back into their own preparation cycles. Here’s how you can start.
Talos Takes:2025’sransomware trends and zombie vulnerabilities In this episode, Amy and Pierre Cadieux unpack the ransomware and vulnerability trends that defined 2025. From the persistent ransomware threats targeting the manufacturing sector to the rise of stealthy “living off the land” tactics, we break down what these shifts mean for your defense strategy.
Germany’s economy is a precision machine: finance fuels it, manufacturing builds it, telecom connects it, IT optimizes it, and healthcare sustains it. The country sits at the crossroads of industrial power and digital transformation, making it irresistibly attractive to attackers.
In this article, we explore real-world attacks targeting five critical German industries, analyzed by ANY.RUN’s analysts using Interactive Sandbox and Threat Intelligence Lookup. Each case is not theory. It is a live wire, recently observed, carefully dissected.
Executive Summary
Germany’s top industries are under coordinated pressure, not isolated attacks.
Identity is the new perimeter: attackers are bypassing infrastructure defenses by hijacking sessions and abusing legitimate authentication flows.
Phishing has evolved into real-time session interception, rendering traditional MFA insufficient on its own.
Attackers adapt lures to business context, increasing success rates against employees.
Threat intelligence is no longer optional: it is critical for reducing detection time, preventing escalation, and protecting revenue
Germany’s Digital Landscape: A High-Value Target
Why Germany?
Largest economy in Europe with strong global ties;
Highly digitized enterprise sector;
Deep reliance on Microsoft 365, cloud services, and SaaS ecosystems;
Critical industries interconnected across supply chains.
Germany’s industrial backbone — the Mittelstand of small and medium-sized enterprises, alongside globally recognized corporations in chemicals, automotive, and engineering — represents a vast attack surface. These organizations often store sensitive IP, manage critical infrastructure, and handle large financial transactions, yet historically have underinvested in cybersecurity relative to their size and importance.
Geopolitics adds fuel to the fire provoking a sharp increase in professional, often state-directed attacks by APT groups (Advanced Persistent Threats) linked to geopolitical conflicts. Germany’s role in the EU, NATO, and global trade makes it a high-value intelligence target for foreign actors.
In 2024, cyberattacks caused approximately €178.6 billion in financial losses to German businesses, equivalent to 67% of all damage from corporate crime. (Bitkom).
83% of German businesses fell victim to ransomware in 2024, according to the Cyber Security Report 2025 by Schwarz Digits.
The BSI’s 2024/2025 reports describe the IT security situation as “tense,” with 309,000 new malware variants appearing daily, ransomware attacks up 77%, and 22 state-sponsored APT groups active on German soil.
Phishing remains the most prevalent attack vector. The BSI confirmed that phishing attacks expanded well beyond the financial sector in 2024, with attackers impersonating streaming services, logistics firms, government agencies, and enterprise software platforms like Microsoft 365.
How German Companies Can Discover Industry-Specific Cyberattacks
ANY.RUN’s Threat Intelligence Lookup, a searchable database of threat data from live malware analysis by a community of over 15K SOC teams, supports the mapping of attack indicators to specific sectors and regions.
A local cyberthreat landscape can be revealed by combining lookups for an industry and a malware sample submission country, and by limiting the search period to see the most recent threats.
1. Finance: FlowerStorm Targets a German Investment Firm
Financial organizations in Germany operate in a high-trust, high-value environment:
Sensitive investment and client data;
Heavy use of cloud-based collaboration tools;
Strict compliance requirements
This makes employee credentials a golden key. Microsoft 365 credential theft is a dominant threat vector in this sector. Attackers seek to compromise corporate email accounts to intercept transactions, conduct Business Email Compromise (BEC) fraud, or use valid credentials as a launchpad for deeper network intrusion.
Threat in Focus: Spearphishing with FlowerStorm
FlowerStorm attack in ANY.RUN’s Interactive Sandbox
Target A German investment company managing portfolios in private equity, real estate, and hedge funds. The attack was precision-targeted: the victim’s corporate email address was embedded directly into the phishing link, encoded in Base64.
Email encoded in spearphishing link
Attack Type Spearphishing (targeted credential theft) for Microsoft 365 accounts. ANY.RUN’s sandbox classified this threat as FlowerStorm — a sophisticated phishing-as-a-service platform known for its multi-stage evasion techniques and precision targeting.
Kill Chain
In this case, the attacks starts with a malicious URL. However, as we can see in other analysis sessions, such links are usually delivered via phishing emails containing a PDF attachment. Inside the PDF is a QR code — a deliberate choice to bypass email-based URL scanners that cannot decode visual content.
The victim scans the QR code and is taken to a landing page with a salary-related lure.
Fake letter about a salary raise
The page loads a FingerprintJS script to profile the victim’s browser before showing any phishing content. This profiling helps attackers filter out security researchers and automated scanners.
Cloudflare Turnstile CAPTCHA is activated, blocking automated analysis tools and sandbox detection attempts.
The victim is redirected to the main phishing domain, which presents a pixel-perfect replica of the Microsoft 365 sign-in page, including a full OAuth flow simulation with client_id, redirect_uri, and response_type parameters.
Credentials entered by the victim are immediately exfiltrated to attacker-controlled infrastructure.
Why It Works FlowerStorm combines multiple layers of evasion (QR codes, browser fingerprinting, CAPTCHA, Base64 encoding) with surgical targeting. The salary-themed lure is psychologically effective: employees in a finance firm expect payroll-related communications, reducing suspicion. The Microsoft 365 OAuth imitation is technically convincing enough to fool even security-conscious users.
2. Healthcare: Microsoft OAuth Abuse Targets a Research Center
This creates a perfect storm for authentication abuse attacks.
Healthcare breaches carry compounded consequences: regulatory penalties under GDPR, reputational damage, potential disruption to patient care, and the loss of research data that may represent years of work and significant public investment.
Threat in Focus: Microsoft OAuth Abuse with Fake Outlook Login
Spearphishing attack personalized by email
Target Germany’s largest medical research center. The attack was highly targeted: the victim’s corporate email appeared in plaintext in the OAuth state parameter and in Base64 in the URL fragment of the phishing page.
Attack Type Phishing via Microsoft OAuth abuse combined with a fake Outlook login page. The attackers exploited Microsoft’s legitimate OAuth 2.0 authentication mechanism, substituting a malicious redirect_uri to capture credentials after the authentication handshake.
Kill Chain
The victim receives a link that begins as a legitimate request to login.microsoftonline.com. The redirect_uri, however, points to a compromised website. The state parameter contains the victim’s email address in plaintext.
If no active Microsoft session exists, Microsoft returns an error=interaction_required response and redirects the user to the redirect_uri, the compromised WordPress site (saicares.com.au), which loads an intermediate invoice.html page.
The intermediate page pulls content from ArDrive (a decentralized storage platform), adding another layer of obfuscation and hosting that is difficult to block.
The victim is redirected to ogbarberschool[.]com — the primary phishing page. The victim’s email appears in the URL fragment both in Base64 and in plaintext, creating a personalized login experience.
The phishing page contains obfuscated JavaScript and displays a convincing fake Outlook login form.
Forged Outlook page
Credentials entered by the victim are exfiltrated via a POST request to jewbreats[.]org/rexuzo/owa/apiowa[.]php. Suricata network rules flagged this as a suspicious unencrypted POST request transmitting an email address.
Personal data exfiltrated to attackers’ server
Why It Works This attack is particularly dangerous because it begins with a genuine Microsoft domain. A victim who inspects the initial link sees a legitimate login.microsoftonline.com URL, providing false reassurance. By the time the malicious redirect occurs, the victim is already engaged. The use of a compromised WordPress site and decentralized storage makes the infrastructure difficult to detect and take down quickly.
3. Technology: Reverse Proxy Phishing Targets an IT Company
IT companies:
Manage infrastructure and credentials;
Have privileged access across systems;
Are often stepping stones for supply chain attacks.
The sector’s familiarity with technology can create a paradoxical blind spot: IT professionals may be more likely to click links in emails that appear technical or work-related, assuming their technical knowledge makes them immune to social engineering.
Threat in Focus: EvilProxy + EvilGinx2 Combined Attack
Phishing detected by ANY.RUN Sandbox
Target A German IT company. The attack targeted a specific employee, whose email was extracted from the data parameter of a Microsoft Safe Links wrapper, indicating the attacker had prior visibility into the target’s email infrastructure.
Attack Type Phishing via a combination of EvilProxy and EvilGinx2: two reverse proxy tools used in tandem. EvilProxy serves as the primary credential harvesting platform, while EvilGinx2 handles session token interception. Together, they create a real-time proxy of Microsoft’s login infrastructure capable of bypassing multi-factor authentication.
Kill Chain
The victim receives a phishing email urging them to “Review document,” a work-relevant lure that fits the daily workflow of an IT professional.
Fake business email with call to action
The embedded link routes through a Mailchimp tracking URL (aviture[.]us7[.]list-manage[.]com), a legitimate email marketing service that lends the link apparent credibility and bypasses reputation-based URL filters.
Mailchimp redirects to larozada[.]com, a compromised WordPress site hosting an intermediate page with a Cloudflare Turnstile CAPTCHA.
After CAPTCHA verification, the victim is routed through a Cloudflare Workers serverless function, which performs additional routing to frustrate analysis and attribution.
The final destination is the main phishing domain (googlmicrozonfaceb0xfileshar3instacloud0fftkdoctormedixxqqw[.]digital) — an EvilProxy instance that reverse-proxies the real Microsoft Login page in real time. The victim sees an authentic Microsoft experience.
As the victim authenticates, EvilProxy intercepts the session cookie. The attacker now has a valid authenticated session. No password or MFA code required.
Why It Works The use of legitimate services (Mailchimp, Cloudflare Workers, WordPress) at each stage of the attack chain makes it nearly impossible for conventional email filters and web gateways to block. The final EvilProxy stage defeats MFA entirely by hijacking the post-authentication session rather than attempting to steal the second factor. This is an adversary-in-the-middle attack that neutralizes one of the most commonly recommended security controls.
Using TI Lookup, we can see that larozada[.]com is intensely correlated with this attack scenario:
Interactive Sandbox contains hundreds of malware samples using this domain
Integrate Threat Intelligence Feeds in your security stack to have it continuously updated with a real-time stream of indicators (domains, URLs, IPs) for early detection and timely response.
Protect revenue, reputation, and operations with enterprise-grade threat analysis and intelligence. Reduce risk with ANY.RUN
Sit at the heart of communications infrastructure;
Handle massive volumes of user data;
Operate complex, distributed environments.
Telecom companies are targeted for multiple strategic reasons: access to customer data at scale, the potential for SIM-swapping attacks, the ability to intercept communications, and the value of internal network access for espionage or infrastructure disruption.
Account takeover via Microsoft 365 credential theft is a priority threat for this sector, as telecom employees use cloud platforms extensively for internal communications, customer management, and operational coordination.
Threat in Focus: EvilProxy without personalization
Phishing page abusing Microsoft services
Target An employee of a German telecommunications company. Unlike the finance and healthcare cases, this campaign used a non-personalized phishing page (no email embedded in the URL) suggesting a broader campaign that may target multiple companies simultaneously rather than a single individual.
Attack Type Phishing via EvilProxy (Phishing-as-a-Service) — a commercial reverse proxy platform that proxies the real Microsoft login page in real time, intercepting session tokens and bypassing MFA without ever needing to steal a password.
Kill Chain
The victim receives a link pointing to portfolio-hrpcjqg[.]format.com/gallery — a legitimate portfolio hosting platform (Format.com). Using a reputable platform as the first hop bypasses domain reputation filters.
Non-personalized phishing page on a legitimate website
Format.com redirects to signin[.]securedocsportal.com/cyb3rusr131 — a phishing domain crafted to resemble a secure document signing portal, a plausible context for a telecom business user.
Cloudflare Turnstile CAPTCHA filters automated scanners and security tools.
After passing CAPTCHA, the victim reaches a page mimicking Microsoft 365 OAuth authorization, complete with client_id and redirect_uri parameters pointing to office.com for added legitimacy.
EvilProxy proxies the real Microsoft Login through its own subdomains, giving the victim a fully functional Microsoft login experience.
The victim enters credentials and completes MFA. EvilProxy intercepts the session cookie in real time, granting the attacker full authenticated access to the victim’s Microsoft 365 account without needing the password or MFA token.
Why It Works EvilProxy is commercially available as a service, dramatically lowering the skill threshold for attackers. The use of a legitimate portfolio platform as the initial URL makes detection by email gateways extremely difficult. The MFA bypass via session cookie theft is highly effective against organizations that believe MFA alone is sufficient protection.
5. Manufacturing: Brand-Impersonation and Teams Lure
Germany’s manufacturing sector:
Is globally dominant;
Relies on internal communication platforms;
Often integrates IT and OT environments.
Germany’s manufacturing sector is the engine of its economy, encompassing global leaders in chemicals, automotive, engineering, and consumer goods. They are also increasingly connected: Industry 4.0 technologies, IoT sensors, operational technology (OT), and cloud-integrated production systems have blurred the line between IT and physical operations.
The consequences of a successful attack extend beyond data loss to potential operational shutdown, physical equipment damage, and supply chain disruption.
Social engineering attacks targeting manufacturing employees are particularly effective because plant-floor and operations staff are not traditionally cybersecurity-trained, and Microsoft Teams has become a standard communication tool across these large organizations.
Threat in Focus: Teams Voice Message Phishing
Fake Microsoft Teams phishing attack
Target A large German industrial conglomerate, a global producer of chemical products and consumer goods. This attack was unusually specific: the phishing domains were registered to include the target company’s name, and the fake login page was styled to match the company’s Microsoft Teams branding — indicating advance reconnaissance.
Attack Type Phishing via EvilProxy using a Microsoft Teams voice message as bait. The attack was delivered via Amazon SES, a legitimate email delivery infrastructure, making it difficult for email security tools to flag based on sender reputation.
Kill Chain
The victim receives an email sent through Amazon SES, notifying them of a missed voice message in Microsoft Teams — a common notification that workers in large organizations receive regularly
Fake email voice message notification
The link leads to voicbx[.]com, a redirect service mimicking a Teams voice notification interface.
Redirects to noncrappyandroidapps[.]com for an anti-bot verification step.
TinyURL then routes the victim to teams-ms365[.]cloud, a phishing domain mimicking Microsoft Teams infrastructure.
The victim lands on a fake Teams voice message page, styled specifically to match the target company’s branding — a degree of customization that indicates prior research into the target.
When the victim attempts to play the voice message, they are redirected to EvilProxy domains that also contain the company’s name in the URL.
The victim enters their credentials into a fake Okta authentication page and completes MFA. EvilProxy intercepts the session cookie, granting the attacker full access to the corporate Microsoft 365 environment without requiring the password or MFA factor.
Why It Works The combination of a highly plausible lure (missed Teams voice message), delivery via Amazon SES (bypassing sender reputation filters), and company-branded phishing pages makes this attack unusually convincing. The use of Okta for the fake authentication page suggests the attackers were aware of the target company’s specific identity infrastructure.
Food for Thought: What CISOs Need to Be Aware Of
1. Five Critical German Industries Are Under Active Attack Right Now
All five cases have been collected between January and March 2026. Finance, healthcare, IT, telecommunications, and manufacturing, the five most economically significant sectors in Germany, are not theoretical targets. They are active targets. This is systematic pressure on the German economy, not isolated incidents.
ANY.RUN’s Threat Intelligence Lookup data reinforces this: searching for EvilProxy and FlowerStorm threats linked to German organizations over the past 60 days returned more than 220 analyses, confirming that these campaigns are ongoing and widespread.
Industries targeted by modern phishing campaigns in Germany
2. Selective Targeting Is a Growing Trend
Several of these attacks show clear signs of advance reconnaissance. Phishing domains were registered with the target company’s name embedded, pages were styled to match corporate branding, and victim email addresses were pre-loaded into URLs. This level of preparation (particularly in the manufacturing case) goes beyond generic mass phishing and suggests attackers are investing in targeted intelligence gathering before launching campaigns. Some cases also used universal phishing pages, indicating a mix of targeted and mass-scale approaches within the same threat actor ecosystem.
3. Social Engineering Is Being Adapted to Professional Context
The lures used in these attacks are not generic. A salary-themed document for a finance employee, a missed Teams voice message for a manufacturing executive, a “Review document” prompt for an IT professional. Attackers appear to be selecting bait that fits the professional context of their targets, increasing click rates and reducing suspicion. This contextual adaptation of social engineering is a significant evolution in phishing tradecraft.
4. Phishing-as-a-Service Platforms Have Democratized MFA Bypass
EvilProxy, EvilGinx2, and FlowerStorm are not bespoke tools used by elite threat actors. They are commercially available phishing platforms sold as services. This means the barrier to launching a sophisticated, MFA-bypassing attack against a German enterprise is now accessible to a broad range of cybercriminals. These platforms proxy real Microsoft login pages in real time, intercept session cookies after successful MFA completion, and provide the attacker with a fully authenticated session — all without ever knowing the victim’s password or one-time code.
Organizations that rely on MFA as their primary defense against credential theft need to understand that adversary-in-the-middle phishing renders standard MFA ineffective. Phishing-resistant MFA (such as FIDO2 hardware keys) and Zero Trust session validation are required to defend against these techniques.
Protecting High-Risk Organizations: A Practical Approach for Decision-Makers
For executives across finance, healthcare, telecom, IT, and manufacturing, cybersecurity is no longer just a technical function. It is a business continuity and risk management discipline.
The attacks described in this article share a common trait: they move fast, abuse trusted services, and bypass traditional defenses.
To counter this, organizations need more than tools. They need a workflow-driven approach, where threat intelligence and malware analysis directly improve how the SOC operates.
Here is how this translates into measurable protection across core SOC workflows.
1. Monitoring: Detect Earlier, Reduce Exposure
The Challenge: Detection gaps, delayed visibility into new campaigns, and high volumes of low-context alerts.
The Challenge: Limited visibility into attack scope and delayed containment decisions.
What to do:
Use Interactive Sandbox to analyze full attack chains (redirects, payloads, exfiltration);
Correlate findings with TI Lookup to understand spread and related infrastructure;
Generate detailed reports for response and compliance.
Incidents are no longer black boxes. Teams gain full kill-chain visibility within seconds and reduce response time significantly
Business impact:
Faster containment and remediation (90% of threats visible in 60 seconds);
Reduced operational disruption;
Lower likelihood of repeat incidents.
Executive outcome: minimized financial and operational impact from active threats.
4. Threat Hunting: Shift from Reactive to Proactive Security
The Challenge: Outdated data, manual validation, and lack of prioritization based on business risk.
What to do:
Use TI Feeds to track emerging threats targeting your industry and region;
Pivot with TI Lookup across related indicators and campaigns;
Use sandbox insights to refine detection logic and hunt hypotheses.
Threat hunting becomes data-driven and context-aware, leveraging live attack activity across thousands of organizations.
Business impact:
Detection of threats before alerts trigger;
Reduced attacker dwell time;
More precise prioritization of high-risk threats.
Executive outcome: improved risk visibility and proactive defense posture.
Operational Impact → Business Outcomes
When these capabilities are aligned across workflows, the effect compounds:
Operational gains:
Faster case processing (minutes saved per investigation);
Higher detection rates (up to +36%);
Fewer escalations and analyst overload;
Shorter incident lifecycle.
Business outcomes:
Reduced risk of breaches and account takeover;
Lower cost of security operations;
Minimized downtime and service disruption;
Stronger compliance and audit readiness;
The difference between a resilient organization and a vulnerable one is not whether attacks happen. It is whether your teams can see threats early, understand them instantly, and act before impact spreads.
By combining TI Feeds (visibility), TI Lookup (context), and Interactive Sandbox (depth), you turn security operations into a measurable business advantage, not just a defensive necessity.
Accelerate investigations and stop threats earlier.
Leverage sandbox visibility and TI to improve SOC performance.
The five attacks documented in this report share a common thread: they are sophisticated, targeted, and actively exploiting the trust that German employees place in familiar platforms like Microsoft 365, Outlook, and Teams. They represent a new generation of phishing campaigns that have moved far beyond bulk spam — into precision-engineered operations that research their targets, customize their lures, and deploy infrastructure specifically designed to survive detection.
The good news is that these attacks are detectable. ANY.RUN’s Interactive Sandbox can analyze suspicious URLs and files in real time, tracing every redirect, every script, every network connection in the attack chain. The Threat Intelligence Lookup provides historical context — showing how many organizations have seen the same indicators, which industries are most targeted, and what threat families are most active.
In an economy where a single successful breach can cost billions and disrupt national supply chains, visibility and speed of response will define resilience.
About ANY.RUN
ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, helps security teams investigate threats faster and with greater clarity across modern enterprise environments.
It allows teams to safely execute suspicious files and URLs, observe real behavior in an Interactive Sandbox, enrich indicators with immediate context through TI Lookup, and monitor emerging malicious infrastructure using Threat Intelligence Feeds. Together, these capabilities help reduce investigation uncertainty, accelerate triage, and limit unnecessary escalations across the SOC.
ANY.RUN is trusted by thousands of organizations worldwide and meets enterprise security and compliance expectations. It is SOC 2 Type II certified, demonstrating its commitment to protecting customer data and maintaining strong security controls.
FAQ
Why are German companies increasingly targeted by cybercriminals?
Germany’s strong economy, high digitalization, and reliance on cloud services make its organizations high-value targets with scalable attack surfaces.
What industries are most at risk?
Finance, healthcare, IT, telecom, and manufacturing show consistently high risk due to data sensitivity, operational complexity, and business impact.
What makes modern phishing attacks more dangerous?
They now use reverse proxy tools and OAuth abuse to capture authenticated sessions, allowing attackers to bypass MFA and access accounts in real time.
What is session hijacking and why does it matter?
Session hijacking allows attackers to steal active login sessions instead of credentials, granting immediate access without needing passwords again.
How does threat intelligence help prevent attacks?
It provides context, detection speed, and visibility into attacker infrastructure, enabling faster decisions and proactive defense.
What is the difference between TI Lookup and TI Feeds?
TI Lookup is used for investigating specific indicators in real time, while TI Feeds provide continuous streams of threat data for proactive blocking.
Can these attacks be stopped before impact?
Yes, with the right combination of threat intelligence, sandboxing, and fast-response workflows, organizations can detect and contain threats early.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-04-09 13:06:342026-04-09 13:06:34How Phishing Is Targeting Germany’s Economy: Active Threats from Finance to Manufacturing
BTS, a global K-pop phenomenon, has recently made a comeback from an almost four-year hiatus: the members of the group were completing mandatory military service in South Korea. For this reason it comes as no surprise that cybercriminals have taken advantage of the band’s highly anticipated world-tour — ARIRANG — to launch a campaign of fake websites targeting fans eager to buy tickets.
We’ve identified at least 10 fraudulent domains that mimic the official pre‑sale pages for the band’s concerts in Argentina, Brazil, Chile, Colombia, France, Mexico, Peru, Portugal, and Spain — all created in early April. We explain how the scammers operate, and how to avoid buying fake tickets.
How the fake ticket scam works
Due to the high demand for the world-tour tickets, some of the event organizers prepared additional measures to ensure there are no ticket scalpers. In Brazil, the ticketing services adopted a “pre‑booking” format: the user first makes an online reservation, and then pays in person at the box office. Although in essence a good idea, the change has caused confusion among fans and created an opportunity for criminals to commit fraud.
Scammers create pages that are nearly identical to the official ones, replicating the layout, design, and the entire purchasing journey. For ordinary users, the experience seems completely legitimate. The links to these websites are circulating on social media — mainly on Instagram.
In Brazil, victims are prompted to make payments via PIX — an instant payment system operated by the Central Bank of Brazil. In some cases, the sites even simulate a card‑payment option, but claim high demand or system errors to pressure users into choosing PIX. PIX payments are then directed to money mule accounts — making it difficult to recover the funds.
Fake website imitating the Brazilian Ticketmaster. The design is almost indistinguishable from the original
This fake Brazilian website makes it seem as if the user can choose between card payment and instant payment. In reality, choosing the bank card option always results in fake “errors”. In the end, the victim is left with no choice but to pay via the PIX system
This scam page targeted at Mexican fans is selling a fake BTS membership. It’s a fraudulent copy of Weverse — a legitimate website that hosts K-pop communities and sells fan-club memberships
This is the French version of a fake Ticketmaster
The scam is a perfect example of how social engineering works. It exploits a massive and highly engaged fanbase — leading many users to act impulsively. The fake “errors” that the website displays during payment create a sense of urgency and cause panic — the scammers are well aware of how quickly BTS tickets sell out. In addition, doubts about the new purchasing system established by the event organizers help criminals make fake websites even more convincing.
How to protect yourself from ticket scams
If you really want to get tickets to your favorite group’s concert but not fall victim to the scammers, it’s important to keep these basic cybersecurity rules in mind:
Access only official ticketing services, which you can find on the official page dedicated to BTS’s tour. Type the website address directly into your browser, and avoid links received via messages, social media, or email.
Check the domain carefully. Slight changes in the address often indicate fraud. This includes additional dashes, unusual territorial domains, and hardly-noticeable changes like replacing a lowercase “l” (L) with an uppercase “I” (i).
Check the website for Privacy Policy and Terms of Use pages. If they’re missing, you’re definitely visiting a fake website. But remember: their presence doesn’t guarantee that the site is legitimate. With modern AI, generating such pages takes only a few seconds.
Carefully check the sales format for each country. In Brazil, payment should only be made in person, so any request for online payment during the pre‑sale is a strong indication of a scam. Other countries and event organizers may offer online payments.
If you’ve been scammed, immediately contact your bank. If you provided bank card information to the criminals, you should reissue your card to prevent further unauthorized payments.
Enable banking alerts. Real-time notifications allow you to quickly identify suspicious transactions.
Use cybersecurity protection that detects and automatically blocks fraudulent websites. Kaspersky Premium, our robust cybersecurity solution, also shuts down phishing attempts, protects your personal data, and helps safeguard your identity.
Beware of “free” or “discounted” tickets. Ultimately, there’s never such a thing as a free lunch — especially when it comes to world‑famous music groups.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-04-09 13:06:342026-04-09 13:06:34Fake BTS ARIRANG tour tickets: K-pop fans being targeted by scammers | Kaspersky official blog
Cyble Research & Intelligence Labs (CRIL) weekly vulnerability report tracked 1,960 vulnerabilities last week, reflecting a continued surge in vulnerability disclosures across enterprise and cloud ecosystems.
Of these, 248 vulnerabilities have publicly available Proof-of-Concept (PoC) exploits, significantly increasing the likelihood of real-world attacks and accelerating exploitation timelines.
Additionally, at least 5 vulnerabilities were actively discussed across underground forums, indicating strong attacker interest and rapid weaponization.
A total of 214 vulnerabilitieswere rated critical under CVSS v3.1, while 57 were rated critical under CVSS v4.0.
Furthermore, CISA added 4 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild.
On the industrial side, CISA issued 7 ICS advisories covering 10 vulnerabilities, impacting vendors such as Schneider Electric, WAGO, and PTC.
Weekly Vulnerability Report’s Top 5 CVE’s
CVE-2026-32917 — OpenClaw (Critical)
CVE-2026-32917 is a critical remote command injection vulnerability affecting OpenClaw, an AI agent framework.
The flaw occurs in the iMessage attachment staging workflow, allowing attackers to inject commands into remote systems. Successful exploitation enables arbitrary command execution, potentially leading to full system compromise.
CVE-2026-4747 — FreeBSD RPCSEC_GSS (Critical)
CVE-2026-4747 is a critical stack-based buffer overflow vulnerability in FreeBSD caused by improper bounds checking in packet handling.
Attackers can send specially crafted requests to trigger a stack overflow, resulting in remote code execution with kernel-level privileges, enabling full system takeover.
CVE-2026-31883 — FreeRDP (Critical)
CVE-2026-31883 is a heap-based buffer overflow vulnerability in FreeRDP’s audio decoding components.
A malicious RDP server or man-in-the-middle attacker can exploit this flaw to execute arbitrary code, potentially compromising remote desktop clients and enterprise environments.
CVE-2026-1207 — Django (High)
CVE-2026-1207 is a SQL injection vulnerability in Django applications using PostGIS RasterField lookups.
Insufficient input validation allows attackers to inject malicious SQL queries, leading to data exposure, modification, and potential lateral movement within backend systems.
CVE-2025-53521 — F5 BIG-IP APM (Critical)
CVE-2025-53521 is a critical vulnerability in F5 BIG-IP Access Policy Manager, initially classified as a DoS flaw but later reclassified as unauthenticated remote code execution following active exploitation.
This vulnerability allows attackers to gain full control of access management systems, posing significant risks to enterprise networks.
Data Source: Cyble Vision
Vulnerabilities Added to CISA KEV
CISA continued expanding its KEV catalog, reflecting active exploitation trends.
Notable addition:
CVE-2025-53521 — F5 BIG-IP APM Initially considered a denial-of-service flaw, it was reclassified as a remote code execution vulnerability after evidence of active exploitation emerged.
This shows how vulnerabilities can evolve in severity over time, reinforcing the need for continuous reassessment and monitoring.
Critical ICS Vulnerabilities
CISA issued 7 ICS advisories covering 10 vulnerabilities, with several rated critical.
Data Source: Cyble Vision
CVE-2026-2417 — Pharos Controls (Critical)
This vulnerability involves missing authentication for critical functions in Mosaic Show Controller firmware.
Attackers can exploit this flaw to gain unauthorized control over industrial systems, potentially disrupting operations.
CVE-2025-49844 — Schneider Electric Plant iT/Brewmaxx (Critical)
A use-after-free vulnerability in Schneider Electric’s industrial automation platform can lead to memory corruption and system compromise.
The presence of multiple vulnerabilities in this platform reflects systemic risk across widely deployed industrial environments.
CVE-2026-3587 — WAGO Managed Switches (Critical)
This vulnerability exposes hidden functionality in industrial switches, potentially enabling attackers to bypass controls and gain unauthorized access.
CVE-2026-4681 — PTC Windchill PDMLink (Critical)
This vulnerability involves improper control of code generation and currently has no available patch, leaving organizations exposed.
Grassroots DICOM (High, Unpatched)
A memory management flaw in Grassroots DICOM impacts healthcare imaging systems, with no vendor patch available, increasing risk to medical infrastructure.
Impacted Critical Infrastructure Sectors
Analysis shows that:
Commercial Facilities appear in 70% of ICS vulnerabilities
Critical Manufacturing and Energy each account for 60%
Healthcare, communications, and transportation sectors also face exposure.
Data Source: Cyble Vision
This distribution shows the strong cross-sector dependencies, where vulnerabilities in industrial platforms can cascade into multiple critical infrastructure domains.
Conclusion
This week’s findings highlight a convergence of:
Increasing vulnerability volume and severity
Rapid exploitation cycles driven by PoC availability
Active underground discussion and weaponization
Persistent weaknesses in industrial control systems
With 248 publicly available PoCs, KEV additions confirming active exploitation, and unpatched ICS vulnerabilities, organizations face significant risk across both enterprise IT and operational technology environments.
Key Recommendations
Prioritize vulnerabilities based on exploit availability and operational impact
Patch critical enterprise systems and externally exposed services immediately
Implement strong input validation and secure coding practices
Harden remote access and RDP environments
Segment IT and OT networks to limit lateral movement
Apply compensating controls for unpatched ICS vulnerabilities
Conduct regular vulnerability assessments and penetration testing
Cyble’s attack surface management and vulnerability intelligence solutions enable organizations to identify exposed assets, prioritize remediation, and detect early indicators of compromise. By combining threat intelligence with proactive defense strategies, organizations can effectively mitigate evolving risks across enterprise and critical infrastructure environments
Every year, Cisco Talos publishes Year in Review, a comprehensive look at the previous year’s threat landscape. It’s drawn from an enormous volume of telemetry, such as endpoint detections, network traffic, email data, and boots-on-the-ground Cisco Talos IncidentResponse (TalosIR)engagements.
As incident responders, we see threats mid-detonation in the wreckage of an Active Directory environment, or in the lateral movement artifacts left behind by an affiliate who got in using nothing more than a valid account. The Year in Review distills those raw observations into structured intelligence, but that intelligence loop works both ways. The same report that our IR casework feeds into is the report that defenders should be feeding back into their own preparation cycles.
IR casework shapes the Year in Review, the Year in Review shapes your readiness
When Talos IR closes out an engagement with customers, the tactics, techniques, and procedures (TTPs) we observe through forensic work and analysis are catalogued, aggregated, and analyzed alongside broader Cisco telemetry. When we track the emergence of a new exploit like React2Shell redefining attacker speed, or when we see Qilin rise to dominate the ransomware landscape while legacy groups like others maintain rare, sustained momentum, those shifts in the adversary ecosystem become the intelligence that informs what we are on the lookout for during the next investigation. When we observe patterns of behavior, they may form trend lines that span multiple years and reveal how the landscape is evolving.
For defenders, this means the Year in Review is not a theoretical document. It is a distillation of what actually happened to organizations we respond to, investigated by the people who were in the room when things broke down. Here are some suggestions on how to operationalize these findings.
Turning findings into tabletop scenarios
One of the most immediate and practical applications of Year in Review is raw material for tabletop exercises. The report hands you the adversary playbook. For example, the 2024 Year in Review highlighted that identity-based attacks accounted for 60% of all Talos IR cases, with Active Directory being the focal point in 44% of those incidents. Attackers were not breaking down doors with zero-days; rather, they were walking through the front door with stolen credentials, often bypassing multi-factor authentication (MFA) through push fatigue, misconfigured policies, or the simple fact that MFA was never fully enrolled in the first place for some accounts.
The 2025Year in Review reinforces and deepens this picture. Attacks against MFA evolved significantly, with MFA spray attacks doubling down on identity and access management (IAM) infrastructure while expanding efforts against high-value privileged accounts. Device compromise attacks saw a significant rise in activity, showing that actors increasingly value reliable, repeatable access methods over one-off exploitation. These are adversary preferences that should directly shape your exercise scenariosand cybersecurity preparedness.
That is a ready-made tabletop scenario. Work with your team on this exact entry scenario and walk through it just as adversary would. An adversary authenticates to your VPN. MFA fires, but the user approves the push because they were already expecting a login prompt. The attacker is now inside your perimeter with legitimate access. What does your detection look like? How quickly do your analysts identify the anomaly? Who makes the call to force a password reset and revoke sessions? These are some good questions to cover in this scenario. The 2025 Year in Review found that actors tailor their MFA attack style depending on the sector, and that manufacturing was the most impacted sector for ransomware in 2025, underscoring persistent risk to repeatedly targeted industries. If you operate in manufacturing, health care, or another sector that has appeared consistently in ransomware targeting data, your tabletop should reflect the specific TTPs directed at your vertical — not a generic ransomware exercise. These are just some ideas to get started on scenarios.
Validate your detections against real-world tradecraft
Beyond tabletops, the Year in Review provides a prioritized list of what to test your detections against. Year after year, Talos IR engagements reveal a consistent core of adversary tradecraft that organizations are still struggling to detect. Tools like PowerShell and Mimikatz appear in a significant portion of engagements. Remote services such as RDP and SSH continue to be abused for lateral movement. Ransomware operators are increasingly disabling security solutions before deploying payloads, and in 2024, they succeeded in doing so at an alarming rate.
The 2025 Year in Review adds critical nuance to detection priorities through its vulnerability analysis. The top 10 most targeted vulnerabilities tell a story about what attackers reach for. React2Shell redefined attacker speed and targeting, compressing the window between disclosure and exploitation. ToolShell’s quick rise to the top five highlighted the sheer volume and impact of attacks exploiting development tool vulnerabilities.
For defenders, this is a checklist. Can your endpoint detection and response (EDR) detect and alert on the disabling of its own agent? Do you have detections for credential dumping from LSASS or web shell deployment? What about a scenario where direct exploitation takes place, but no web shell is deployed? Are you monitoring for anomalous Remote Desktop Protocol (RDP) sessions originating from unexpected source hosts? The Year in Review tells you what the adversary is actually doing, not what they might hypothetically do. That distinction is critical when you are prioritizing detection engineering across your organization.
Map these findings to the MITRE ATT&CK framework, which the Talos Quarterly IR Trend Reports and the Year in Review already reference, and you have a structured way to assess your coverage gaps. If valid account abuse is the dominant initial access technique and your detections are heavily weighted toward exploit-based intrusions, you have a mismatch between your defensive posture and the actual threat landscape.
Stress-test your IR plan, not just your tooling
The Year in Review also reveals patterns in where organizations struggle that go beyond technology. Across multiple years of IR engagements, common security weaknesses keep surfacing: incomplete asset inventories, inconsistent logging, missing or misconfigured MFA, inadequate network segmentation, and unpatched or end-of-life network devices that remain exposed. The 2024 report noted that some of the most targeted network vulnerabilities affected end-of-life devices with no available patches, yet those devices remained in production environments. The 2025 data reinforce this with even sharper clarity: Legacy systems remain highly vulnerable to attack, CVE age distribution data highlights systemic patch delays, and a small number of vulnerabilities in network infrastructure continue to drive outsized risk.
Two additional areas from the 2025 report deserve attention in your planning cycle. First, phishing continues to evolve. Phishing plays a key role in both initial access and post-compromise activity, with business email compromise-style and workflow-based lures remaining the primary theme. Travel and logistics lures surged, while political lures dropped off and IT-themed lures became more prominent. These shifts matter for security awareness training; if your phishing simulations are still heavily weighted toward current-events lures, they may not reflect what your users are encountering.
Second, the AI threat landscape warrants monitoring. The 2025 observations include dedicated coverage of how AI is shaping the threat environment. While the full scope of AI-enabled threats is still emerging, defenders should consider how AI may be lowering the barrier for adversaries in areas like phishing content generation, vulnerability discovery, and social engineering at scale. Your IRplans should be tested, validated, and updated to handle the new security regime we find ourselves in.
Build a year-round preparation cadence
Rather than treating the Year in Review as a one-time read, consider building a recurring preparation cycle around it. When the report drops, review the top-level findings with your security leadership and identify the three or four trends most relevant to your environment. In the quieter early months, run a tabletop exercise built around the most applicable scenario. Through the middle of the year, use Quarterly IR Trend Report data to adjust detection priorities and validate coverage. Before year-end, when threat activity tends to intensify, conduct a focused review of your IR plan.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-04-09 11:06:432026-04-09 11:06:43From the field to the report and back again: How incident responders can use the Year in Review
90% of attacks start with phishing. For CISOs, the real pain begins when the SOC cannot quickly tell whether a suspicious alert is just noise or the start of credential theft, account compromise, malware delivery, or wider business disruption.
Modern phishing campaigns are designed to create exactly that uncertainty. QR codes, redirect chains, CAPTCHAs, phishing kits, and AI-generated lures can all hide the real objective until late in the attack flow.
So what does phishing detection that actually works look like for a modern SOC or MSSP? Let’s find out.
Why Modern Phishing Still Breaks SOC Workflows
Phishing is still one of the most common ways attackers get into organizations, but the threat no longer follows a simple pattern. Modern phishing campaigns are built to hide their real intent, delay validation, and make investigation harder for already overloaded security teams.
What makes today’s phishing especially disruptive is the mix of techniques now used in a single campaign. Security teams are no longer dealing with one suspicious email and one malicious link. They are dealing with layered attack flows that may include:
Phishing-as-a-Service kits that make advanced attacks easier to launch
AI-generated lures and deepfake content that make phishing more convincing
This combination puts much more pressure on SOC workflows. The challenge is understanding what actually happens next and doing it fast enough to reduce business risk.
The numbers reflect this shift. 20% of phishing campaigns hide links in QR codes, while Tycoon2FA attacks increased by 25% between Q1 and Q3 2025. Gartner also found that 62% of companies experienced a deepfake attack in 2025. Together, these trends show that phishing is more adaptive, more evasive, and more difficult to investigate quickly.
Numbers proving the danger of modern phishing attacks
For SOC teams, this creates a dangerous workflow gap. An alert may show that something looks suspicious, but it often does not reveal whether credentials are being harvested, whether MFA is being bypassed, whether malware is delivered after the phishing stage, or how far the attack could spread if it succeeds. That lack of visibility is where delays begin.
When visibility breaks down, the workflow usually breaks down with it:
triage takes longer
confidence in decisions drops
more cases are escalated
response slows at the exact moment speed matters most
To make phishing detection work, CISOs need an approach that helps the SOC spot threats sooner, understand their impact earlier, and contain them before they escalate.
Step 1: Strengthen Monitoring with Fresh Phishing Intelligence
The first step is making sure the SOC can see phishing activity early enough to act on it. If malicious domains, URLs, or campaign indicators surface too late, the team starts every investigation from behind.
Strong monitoring is not just about collecting more alerts. It is about improving what the SOC sees first and giving teams a better chance to catch phishing before it spreads further. The more current and relevant the intelligence is, the easier it becomes to recognize real threats early and prioritize them correctly.
This is where the quality and scale of threat data make a real difference. ANY.RUN’s phishing intelligence is built on first-hand investigations of active campaigns observed across 15,000 organizations and used by more than 600,000 security professionals worldwide. That gives teams access to fresh phishing indicators grounded in real attack activity, not just static or generic reputation data.
TI Feeds delivering actionable IOCs into your existing stack
With this kind of monitoring in place, SOC teams can:
spot malicious URLs, domains, and payloads earlier
improve coverage across emerging phishing campaigns
enrich detections with context tied to real investigations
prioritize alerts faster and with more confidence
A stronger monitoring layer gives the SOC a much better starting point. And when phishing is detected earlier, every step that follows becomes more effective.
Step 2: Improve Triage with Full Attack-Chain Visibility
Early detection is only the starting point. Once a phishing alert reaches the SOC, the next challenge is figuring out what the attack is actually doing and whether it creates real business risk.
This is where triage often slows down. A suspicious URL or attachment may trigger an alert, but that alone does not show whether the campaign leads to credential theft, MFA bypass, malware delivery, or a broader account takeover attempt. Without that visibility, teams spend more time validating the threat, confidence in verdicts drops, and more cases are escalated than necessary.
Strong phishing triage should help teams quickly answer a few critical questions:
Where does the attack flow actually lead?
Is the user being pushed to a fake login page?
Are credentials or session tokens being stolen?
Does the phishing stage end in malware delivery?
ANY.RUN helps close this gap with Interactive Sandbox analysis that exposes the full phishing chain in a safe environment. Teams can detonate suspicious URLs and files, follow redirects, open attachments, scan QR codes, and inspect CAPTCHA-protected flows to see how the attack behaves in practice.
Instead of relying on assumptions, they can validate the threat based on what actually happens. Analysts can also interact with the environment at any time, which makes it easier to investigate suspicious behavior manually when a deeper look is needed.
See how a real quishing attack can be analyzed inside ANY.RUN’s Interactive Sandbox in seconds:
Quishing attack analyzed inside ANY.RUN sandbox
This process becomes even faster with Automated Interactivity. By imitating analyst behavior inside the sandbox, it can interact with phishing pages automatically, uncover hidden links behind QR codes, solve CAPTCHAs, and continue the analysis flow without waiting for manual input. That helps teams move through evasive phishing stages faster and reach the real malicious behavior sooner.
Stronger triage reduces uncertainty, cuts wasted effort and helps teams reach conclusions faster. That means fewer unnecessary escalations, quicker containment, and less chance for phishing incidents to grow into broader operational or financial impact.
Reduce the risk of delayed detection
Help your team investigate faster and respond earlier
Step 3: Speed Up Response with Clear Verdicts and Actionable Evidence
Phishing detection does not end when the SOC confirms that something looks suspicious. The next challenge is turning that analysis into fast, confident response.
This is where many workflows still slow down. Even after a phishing attack has been investigated, teams often need to manually collect indicators, document what happened, map behavior to known techniques, and prepare findings for escalation or response. That extra effort creates delays at exactly the moment when speed matters most.
A strong response workflow should give teams what they need to act without friction:
evidence that helps response teams move with confidence
ANY.RUN helps speed up this stage by turning phishing analysis into decision-ready outputs. Teams can see how the attack unfolds across redirects, phishing pages, credential theft attempts, and payload delivery, often reaching a verdict within the first 60 seconds. Clear verdicts, extracted IOCs, mapped TTPs, visual behavior details, and auto-generated reports make incidents easier to understand and faster to contain.
Auto-generated report for faster response
For CISOs, the real benefit is a faster path from investigation to containment. It helps teams contain phishing incidents sooner, make more consistent decisions under pressure, and reduce the time attackers have to turn a phishing attempt into credential theft, fraud, or wider business disruption.
What SOC Teams Gain from Stronger Phishing Detection
When SOC teams improve monitoring, sharpen triage, and speed up response, phishing becomes much harder to turn into a larger incident. Stronger phishing detection helps teams identify suspicious activity sooner, understand it more quickly, and act with greater confidence when time matters most.
Mains steps for stronger phishing detection with ANY.RUN
This approach drives measurable improvements across day-to-day SOC operations:
36% higher detection rate
up to 58% more threats detected
21 minutes faster MTTR per incident
up to 20% lower Tier 1 workload
30% fewer Tier 1 to Tier 2 escalations
The value goes beyond the numbers. Better phishing detection helps reduce alert fatigue by making suspicious activity easier to assess. It also helps Tier 1 handle more cases with confidence instead of pushing unclear investigations further down the workflow.
Key Outcomes for CISOs:
Lower breach risk through earlier detection and more informed response
Reduce the cost of phishing incidents by containing threats faster
Ease alert fatigue with faster clarity on suspicious activity
Improve SOC efficiency with quicker, better-informed decisions
Reduce Tier 1 workload by helping front-line teams close more cases sooner
Improve consistency in phishing investigations and response workflow
Avoid hardware costs by using cloud-based analysis
Scale operations more easily as phishing volume grows
Get more value from existing teams without adding the same operational burden
Reduce the likelihood of wider business disruption by stopping phishing earlier
Phishing is often the first step in account compromise, fraud, malware delivery, and wider business disruption. When SOC teams can detect it earlier and respond faster, the organization is in a much stronger position to stop the attack before the damage spreads.
About ANY.RUN
ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, helps organizations detect, investigate, and respond to modern phishing attacks with greater speed and clarity.
By combining Interactive Sandbox, Threat Intelligence Lookup, and Threat Intelligence Feeds, ANY.RUN gives SOC and MSSP teams the tools to spot phishing activity sooner, investigate threats more effectively, and respond with structured findings. Its approach helps security teams expose full attack chains, investigate evasive phishing techniques, and make more confident decisions under pressure.
Trusted by more than 15,000 organizations and 600,000 security professionals worldwide, including 74% of Fortune 100 companies, ANY.RUN is built to support modern security operations with faster threat visibility, stronger investigation workflows, and more informed response. The company is SOC 2 Type II certified, reflecting its focus on strong security controls and customer data protection.
![[Video] The TTP Ep. 22: The Collapse of the Patch Window](https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/images/2026/04/YiR2025_cover_2x1-3.jpg)
Key Outcomes for CISOs: