Imagine handing your smartphone over for repair. A couple of days later, you pick it up — and great, it’s working again! But you won’t even realize that your device has been injected with malicious code, allowing attackers to access your smartphone even when it’s locked.
This is the beginning of the story shared by Kaspersky ICS CERT researchers, Alexander Kozlov and Sergey Anufrienko, at the Black Hat Asia 2026 conference. They managed to uncover a vulnerability that flips conventional assumptions about smartphone and IoT security on their head. Its core lies at the very heart of Qualcomm chips.
What is BootROM?
To grasp the severity of this discovery, we first need to look at how a modern device powered by a Qualcomm chip boots up. Think of it as a fortress with multiple layers of security. Each subsequent layer verifies the pass issued by the previous one. The bedrock foundation — the most trusted layer of them all — is the BootROM, a read-only memory baked directly into the silicon that can’t be modified once it comes off the fab.
The BootROM is the very first thing to run when a device powers on. It verifies the signature of the next bootloader, which in turn verifies the next, building a chain of trust all the way up to the operating system. If an attacker can compromise this chain at the BootROM level, it’s game over: the malicious code will execute before the main operating system even has a chance to load.
This is exactly what attackers can do by exploiting the CVE-2026-25262 vulnerability discovered by Kaspersky ICS CERT researchers.
Emergency Download Mode as an entry point
The research began with a protocol called Sahara. This is a component of Emergency Download Mode (EDL). Manufacturers and service centers use it to revive bricked devices: the phone is connected to a computer via USB, and a special utility program signed by the manufacturer (in this case, Qualcomm) is uploaded to it.
Sahara is implemented directly within the ARM PBL (Primary Boot Loader) — the BootROM itself. This means the protocol runs before any operating system boots, before any user access privileges are checked, and before any security controls are activated. The device simply waits for a USB connection, ready to accept data.
The communication scheme looks simple: the device sends a handshake (HELLO) to the computer, the computer selects the mode, a cycle begins to upload the utility program in chunks, and finally, the device executes the uploaded code. And it was within the verification logic of these very file chunks that the vulnerability was identified.
Write-what-where: the core of the vulnerability
In technical terms, the bug introduced by the developers is classified as CWE-123: Write-What-Where Condition. This is about as bad as it gets when it comes to flaws in low-level programming. An attacker can write arbitrary data to an arbitrary address in the device memory.
Without diving too deep into the technical weeds, suffice it to say that by exploiting the discovered vulnerability, attackers can gain access to any data on the device, including user-entered passwords, files, contacts, geolocation data, as well as the hardware sensors like the camera and microphone. In certain scenarios, complete control over the device is possible. Just a few minutes of physical access to the device via a cable connection, and the gadget has been compromised. This creates a risk if you hand your smartphone over to a repair shop, pass it to someone else to set up and install apps on, or just leave it unattended.
Which devices are affected
The CVE-2026-25262 vulnerability affects the following Qualcomm chip series: MDM9x07, MDM9x45, MDM9x65, MSM8909, MSM8916, MSM8952, and SDX50 — every single version released to date, until the vulnerability is patched by the manufacturer.
These are no obsolete museum pieces. The MDM9207, which we used for the bulk of our research, is integrated into modem modules for the internet of things (IoT), industrial equipment, smart home devices, healthcare monitoring systems, logistics trackers, and banking terminals. The MSM8916 powers many budget smartphones, while the SDX50 is used in automotive control units.
How vulnerable devices get attacked
The catch is that the attacker needs physical access to the device to pull this off. In the real world, this translates to:
Smartphone repairs at third-party repair shops, where the phone is left for several hours
Customs checkpoints in certain countries, where devices are withheld, inspected, and then returned
Lost and found scams, where your phone is stolen, tampered with, and then mysteriously found
Corporate espionage via an insider or a rogue employee
With just a few minutes of physical access to the device an attacker can plant a backdoor so deep inside that standard research tools won’t even detect it in most cases.
Why there’s no patch — and what to do
Qualcomm was notified of the discovery in March 2025 and confirmed the vulnerability in its chips. To identify it, the vendor reserved CVE-2026-25262, and on April 20, 2026, Kaspersky ICS CERT published technical information on the vulnerability and recommendations for users.
Qualcomm included this vulnerability in its May security bulletin. While fixing already-made devices is fundamentally impossible, the company promised to make all future chips without this vulnerability.
If you currently own a device with an affected chip, use our recommendations below to help mitigate the risk of infection.
Enforce strict physical control: don’t leave your devices unattended, especially when traveling or on business trips.
Choose only authorized service centers for repairs and maintenance.
Regularly update your firmware — this won’t patch the BootROM vulnerability, but it can eliminate many related vulnerabilities at higher levels.
Use a Kaspersky for Android on your device. This will safeguard your gadget from other threats that, combined with this vulnerability, could lead to unpredictable consequences.
If you notice that your gadget with a vulnerable Qualcomm chip starts acting up — overheating when idle, reporting unexpected spikes in network traffic, or exhibiting strange app behavior — you may have fallen victim to this vulnerability. You can wipe the malicious code and reset your device to its baseline state simply by completely cutting its power. This means either pulling the battery or letting it drain all the way to zero until the gadget shuts down entirely. In this case, the malicious code will most likely not persist on the device — during our research, we were unable to confirm that it could achieve persistence in non-volatile memory.
Want to learn more about severe vulnerabilities in Android phones? Check out these posts:
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-05-23 06:12:052026-05-23 06:12:05Breaking down the new Qualcomm chip vulnerability | Kaspersky official blog
Welcome to this week’s edition of the Threat Source newsletter.
“It takes very little to govern good people. Very little. And bad people can’t be governed at all. Or if they could, I never heard of it.” ― Cormac McCarthy, No Country for Old Men
Most of my career has been built on dichotomy: striving to be a supportive teammate while also pushing every boundary in front of me. I’ve often been told to “never do X, only do Y,” but I’ve invariably chosen to do X anyway (even when fraught with peril) to get to the deeper answer. For years, I was told that I should perform in certain ways — instead of in ways that made sense for my brain and way of learning.
I wasn’t governable, but I wasn’t bad. Just … challenging. While Sheriff Ed Tom Bell’s view of good vs. bad is compelling, maybe our careers should be defined as “acquiescent” vs. “challenging.” It’s less of an existential crisis that way.
Over the past few years, I’ve been enjoying the mentoring aspect of my career. One of the things that I love to share with people is that being ungovernable is very challenging early in career; it’snot a favorite of middle management, but it can take you to places that you really want to be (i.e., Talos). The road is going to be longer and much bumpier than your governable cohort, but this is the long con.
The path to Talos was long and arduous, but I’ve learned to make my career choices through the lens of the axiom, “If you’re the smartest person in the room, you’re in the wrong room.” It’s been the only guidepost I’ve needed. I don’t know that it applies to everyone, because everyone is unique, but it absolutely helps me decide what I want to learn, what I want to dive into, who I want to surround myself with.
The secret lies in the last comment — it’s the people. If you continue to search for the smartest people in the room, you’ll find it and when you do, you’ll find that you aren’t ungovernable — rather, you’re understood. Be ungovernable (but kind) in the short term, find new ways to solve problems, think around solutions in new ways, program in different languages, and be the person in the meeting that says, “I think we should do Y instead, and here’s why.”
I suspect that this is the same approach many of you already take in your daily roles when identifying threats vs. benign activity, choosing your pivots in hunting, or deciding the priorities in device replacement. It’s a natural direction for the intellectually curious, so be kind, but ungovernable.
“The future of intelligence must be about search, while the future of ignorance must be about the inability to evaluate information.” ― Patricia Lockwood, No One Is Talking About This
The one big thing
Cisco Talos has recently discovered a commodityBadIISmalware variant fueling a thriving malware-as-a-service (MaaS) ecosystem for Chinese-speaking cybercrime groups. Identifiable by its embedded “demo.pdb” strings, this toolset boasts a multi-year development cycle complete with builder tools and persistence mechanisms. Threat actors are leveraging this robust framework to easily execute malicious search engine optimization (SEO) fraud, hijack server content, and redirect traffic to illicit sites.
Why do I care?
This is a highly active, commercially driven malware ecosystem. The author constantly pushes rapid updates to introduce new features and actively evade specific security vendors, making it a persistent headache for defenders. Because this BadIISvariant is sold as a commodity tool, it lowers the barrier to entry for cybercriminals, leading to widespread attacks that silently hijack server traffic without triggering obvious alarms.
So now what?
Defenders should actively monitor IIS environments for unauthorized traffic redirection, unexpected reverse proxying, or sudden spikes in “503 Service Unavailable” errors. Threat hunting efforts should also target the distinct “demo.pdb” strings and associated Chinese-language folder paths within IIS binaries. Ensure your endpoint detection solutions are updated to catch these reactive evasion tactics, and read the full blog for complete coverage and indicators of compromise (IOCs).
Top security headlines of the week
CISA exposes secrets, credentials in “private” repo A researcher discovered a public GitHub repository belonging to CISA that contained 844MB of sensitive data, including plain-text passwords, authentication tokens, and other secrets. (Dark Reading)
NYC Health + Hospitals says hackers stole medical data and fingerprints, affecting at least1.8 million people The breach is particularly sensitive because hackers stole biometric information, including fingerprints and palm prints, which affected individuals have for life and cannot replace. (TechCrunch)
Bug bounty businesses bombarded with AI slop Companies that pay hackers to find flaws in their software are being inundated with low-quality (often false) reports generated by AI, forcing some to suspend the programs altogether. (Ars Technica)
FourOpenClawflaws enable data theft, privilege escalation, and persistence The vulnerabilities, collectively dubbed Claw Chain, can permit an attacker to establish a foothold, expose sensitive data, and plant backdoors. (The Hacker News)
New NGINX vulnerability allows remote attackers to trigger malicious code A new vulnerability in NGINX JavaScript (njs) allows unauthenticated remote attackers to trigger a heap‑based buffer overflow that can lead to denial‑of‑service and, in some conditions, remote code execution in the NGINX worker process. (Cyber Security News)
Can’t get enough Talos?
TP-Link, Photoshop, OpenVPN, Norton VPN vulnerabilities Talos’ Vulnerability Discovery & Research team recently disclosed eight vulnerabilities in TP-Link, and one each in Adobe Photoshop, OpenVPN, and Gen Digital’s Norton VPN. The vulnerabilities have been patched by their respective vendors.
Webinar: AI found the problem. Now what? Experts from Talos and Cisco Security will examine how AI is changing the game for both defenders and well-resourced adversaries, and why the most persistent risks often remain rooted in unpatched legacy systems.
Breaking things to keep them safe with Philippe Laulheret From his memorable experiment using a green onion to bypass a biometric fingerprint reader to his experience on the frontlines of cybersecurity, Philippe shares the journey that led him to vulnerability research.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-05-21 18:07:202026-05-21 18:07:20The art of being ungovernable
We’ve written time and again about how QR codes are used in phishing schemes. Our secure email gateway solution even includes technology to read these codes — not just from emails, but also from attachments — and check the embedded links. Yet, attackers haven’t given up on trying to send QR codes to their victims. Lately, we’ve increasingly seen them use ASCII art for this purpose — images composed of characters. This seems particularly ironic considering that phishers once tried to evade link scanning by hiding links in images, and now they’re trying to dodge image scanning by going back to text. But with a few twists.
The lost art of ASCII, and how attackers use it
It’s hard to believe today, but there was a time when computers couldn’t display graphics. Consequently, the very first computer images were constructed from text characters. Following the adoption of the standard in 1963, characters from the ASCII (American Standard Code for Information Interchange) set were used for this type of artwork to ensure that images looked the same across different computers. Over time, other text symbols (for example, from the extended Unicode set) began to be used to create images, but the name “ASCII graphics” remained the term used to describe this art form as a whole. There were serious artists working in this medium, the earliest websites were designed with ASCII art, and even the first computer pornography was rendered with text characters.
As image display technology evolved, ASCII art began to fall out of fashion. It saw a major resurgence in the 2000s during the heyday of email spam. Back then, spammers primarily used it because it allowed them to disguise blatant spam keywords that could trigger mail filters, while also placing less load on mail servers than images. Additionally, since many users paid for volume of internet traffic at the time, they often disabled image loading in their email clients. Naturally, at that time, we augmented our email security solutions with technology specifically designed to block ASCII art.
Now, ASCII art has been rediscovered — this time by those looking to bypass technology that recognizes QR codes within images.
What does ASCII art phishing look like?
Here’s a recent example. The pretext itself is pretty run-of-the-mill: someone has supposedly sent to victim a confidential document via DocuSign, but to open it the recipient needs to scan the QR code in the email to visit a website and enter corporate login credentials.
A QR code rendered with unicode characters. We’ve blurred out a portion of the code to prevent the malicious link from being scanned.
Admittedly, the code looks weird. This is primarily because it’s drawn piece-by-piece in pseudo-graphic elements, and even the gaps between the lines can be seen. In reality, there’s no actual image in the e-mail message code; the QR code looks something like this behind the scenes:
ASCII art inside the email code
As a result, link scanners can’t see the link, and image analysis tools can’t find the URL hidden inside the QR code, so the attackers assume the phishing email is going to reach the victim just fine. Spoiler alert: no, we haven’t forgotten how to block ASCII art.
Is a QR code in an email even normal?
In theory, there are situations where using a QR code makes sense. It’s a fairly convenient way to share contacts, a link to a mobile app, a map location, or a configuration. In other words, it works well whenever information needs to be delivered specifically to the recipient’s mobile device.
However, someone using a QR code to make you enter corporate credentials on a mobile device is an instant red flag. And when that QR code is generated with ASCII art, it’s clearly a phishing attempt or an effort to lure you to a malicious URL. This trick can only have one purpose — an attempt to bypass security controls.
Additionally, we recommend regular security awareness training to educate employees on modern phishing tactics. Specifically, to explain that ASCII art in modern emails can be a telltale sign of an attempted phishing attack.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-05-21 06:06:332026-05-21 06:06:33ASCII art in phishing emails | Kaspersky official blog
Netflix, Apple TV+, Disney+, Hulu, Amazon Prime, YouTube Premium… The average law-abiding family today pays for five to 10 subscriptions just to watch their shows of choice, with the monthly bill easily crossing the hundred-dollar mark. It’s no surprise, then, that social media and online marketplaces are seeing a surge in demand for the “magic boxes” that popped up at the end of 2025: Android-powered TV boxes that promise to unlock thousands of channels and every streaming service subscription-free for a one-time purchase.
Ads for these devices are flooding TikTok and Instagram: smiling influencers unbox the SuperBoxes, plug them into a TV, and browse endlessly through channels. It looks like the ultimate life hack against subscription fatigue, right? In reality, it’s one of the easiest ways to invite a botnet into your home network.
A promotional video on TikTok explaining how great it is when the cheese is free you can just go ahead and cancel all your subscriptions
What’s wrong with these cheap TV boxes?
Stories about malicious TV boxes have surfaced before, but right now, their marketing has reached a truly alarming scale.
At the end of 2025, analysts examined several models of the popular SuperBox device available from major retail stores and online marketplaces. The findings were deeply concerning: immediately upon powering up, the devices began pinging the servers of the Chinese messaging app Tencent QQ, as well as the Grass proxy service — effectively renting out the owner’s internet bandwidth to third parties.
Inside the firmware, researchers discovered applications completely uncharacteristic of a media player: a network scanner, a traffic analyzer, and tools for DNS hijacking. Consequently, the device not only streams pirated content but also scans the local network for other targets (including industrial SCADA interfaces), and stands ready to participate in DDoS attacks. The SuperBoxes were also found to contain folders with the telltale name “secondstage”, a textbook indication of multi-stage malware.
More recently, in April 2026, the Darknet Diaries podcast featured an interview with a security researcher known by the alias D3ada55, who shared plenty of intriguing details about these boxes — including the fact that they were still openly sold on major platforms like Amazon, Walmart, and Best Buy.
The infection chronicles: BADBOX to Keenadu
The SuperBox case is far from the only instance where Android devices have been turned into botnet nodes — or sold infected right out of the box. Here’s a look at the most recent cases:
BADBOX 2.0. In July 2025, Google filed a lawsuit against the operators of a botnet that compromised over 10 million Android devices — mostly cheap TV boxes, tablets, and projectors lacking Google Play Protect certification. As we reported earlier, BADBOX 2.0 specifically targets TV boxes, operating simultaneously as a proxy network and an ad fraud engine.
Kimwolf. In December 2025, the QiAnXin XLab team uncovered a DDoS botnet that had hijacked around 1.8 million Android devices. The infected hardware included generic models from off-brand manufacturers sporting high-profile names like TV BOX, SuperBox, XBOX, SmartTV, and others. The infection footprint was massive, with compromised devices shipped worldwide. Among the hardest-hit countries were Brazil, India, the U.S., Argentina, South Africa, the Philippines, and Mexico.
Keenadu. Our experts discovered this malware lurking in the firmware of brand-new devices back November 2025, though it didn’t gain widespread attention until after we published a study about it in February 2026. Keenadu masquerades as legitimate system components, embedding itself even into facial-recognition unlock apps, potentially granting attackers access to biometrics, banking data, and personal messages.
All of these stories share the same origin: the Triada Trojan, first documented by our researchers back in 2016 and dubbed at the time “one of the most advanced mobile Trojans”. Over the past decade it has evolved from a standard piece of malware into a modular backdoor baked directly into firmware during manufacturing.
How the infection scheme works
Manufacturers of cheap TV boxes cut corners on absolutely everything: Google Play Protect certification, firmware audits, and security updates. Many of these devices run on the Android Open Source Project without any security guarantees whatsoever. Somewhere along the supply chain — whether at the factory, through a middleman, or at a distributor — a backdoor gets injected into the firmware image. Our experts suspect that the manufacturer itself might not even be aware of the compromise.
The sheer scale of the infection turns millions of identical boxes into the perfect foundation for a botnet: every compromised device represents a unique IP address that can be rented out to anyone. Botnet operators like Kimwolf monetize this not only through distributed DDoS attacks but also by reselling the bandwidth of infected smart TVs and streaming boxes.
What this means for you
An infected TV box sits right in your living room, connected to your home Wi-Fi. That means it can see smartphones running banking apps, network-attached storage (NAS) units holding family archives, IP cameras, smart locks, work laptops, and any other the devices connected to your Wi-Fi network.
With this kind of beachhead inside your home network, an attacker can intercept unencrypted traffic, spoof DNS requests, scan ports, and hunt for vulnerabilities on neighboring devices. On top of that, they can use your IP address for fraudulent activity. As a result, in the best-case scenario, your IP will end up blacklisted, and legitimate services will start blocking you for suspicious activity; in the worst-case scenario, law enforcement could come knocking on your door.
How to spot a potentially dangerous gadget
You should be on alert if a device:
Is sold under a no-name brand like T95, X96Q, MX10, TV BOX, SuperBox, or some such
Promises free lifetime access to paid premium services for a one-time fee
Requires you to disable Google Play Protect, or install third-party APK files during the initial setup
Lacks Play Protect certification entirely
Is promoted through aggressive spam campaigns on social media
How to avoid hosting a botnet node
Buy certified TV boxes that feature Google Play Protect, or purchase devices directly from reputable telecom operators and internet service providers.
Isolate all smart home devices. Set up a separate Wi-Fi network on your home router for TV boxes, cameras, smart speakers, robot vacuums, and similar gear, while keeping smartphones, NAS units, and computers on the main network. This prevents malware from spreading to your critical gadgets.
Regularly update the firmware on all your devices, and don’t forget about your router — it’s another vulnerable link in the chain.
Remove any applications from your Android TV box that you didn’t install yourself, especially alternative app stores, Wi-Fi “boosters”, and “system cleaners”.
Monitor your traffic. Modern routers and Kaspersky Premium can display which devices are connecting to where. Frequent connections from a media player to servers in China are a major security red flag.
Install Kaspersky Premiumon all your devices — it protects against Trojans, and blocks the phishing pages often used to distribute infected APK files.
Don’t disable Google Play Protect, and avoid installing APKs from shady sources — this is the primary infection vector that bypasses the official app store.
If in doubt, return the TV box. A cheap streaming device isn’t worth risking your biometrics, banking data, or the reputation of your IP address.
Want to know how else to protect your smart home devices? Read more in our related posts:
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-05-20 17:07:052026-05-20 17:07:05Malicious TV boxes: how a cheap “SuperBox” turns your home into a proxy node for cybercriminals | Kaspersky official blog
A complete decoupling from US technology is neither realistic nor necessary, but the changing environment does require nations and companies to reassess their relationships and dependencies
Cisco Talos’ Vulnerability Discovery & Research team recently disclosed eight vulnerabilities in TP-Link, and one each in Adobe Photoshop, OpenVPN, and Gen Digital’s Norton VPN.
The vulnerabilities mentioned in this blog post have been patched by their respective vendors, in adherence to Cisco’s third-party vulnerability disclosure policy, except the Norton VPN vulnerability, which was discovered in-use before a patch was available.
For Snort coverage that can detect the exploitation of these vulnerabilities, download the latest rule sets from Snort.org, and our latest Vulnerability Advisories are always posted on Talos Intelligence’s website.
TP-Link vulnerabilities
Discovered by Lilith >_> of Cisco Talos.
The TP-Link Archer AX53 is a dual band gigabit Wi-Fi router. Talos has disclosed eight vulnerabilities, as follows:
TALOS-2025-2302 (CVE-2026-30814) is a stack-based buffer overflow vulnerability in the tmpServer opcode 0x436 functionality of Tp-Link AX53 v1.0 1.3.1 Build 20241120 rel.54901(5553). A specially crafted set of network packets can lead to arbitrary code execution. An attacker can send packets to trigger this vulnerability.
TALOS-2025-2303 (CVE-2026-30815) is an OS command injection vulnerability in the OpenVPN configuration restore script_security functionality of Tp-Link Archer AX53 v1.0 1.3.1 Build 20241120 rel.54901(5553). A specially crafted configuration value can lead to arbitrary command execution. An attacker can upload a malicious file to trigger this vulnerability.
TALOS-2025-2304 (CVE-2026-30816) is an external config control vulnerability in the OpenVPN configuration restore crt.sed functionality of Tp-Link Archer AX53 v1.0 1.3.1 Build 20241120 rel.54901(5553). A specially crafted configuration value can lead to arbitrary file reading. An attacker can upload a malicious file to trigger this vulnerability.
TALOS-2025-2305 (CVE-2026-30817) is an external config control vulnerability in the OpenVPN configuration restore route_up functionality of Tp-Link Archer AX53 v1.0 1.3.1 Build 20241120 rel.54901(5553). A specially crafted configuration value can lead to arbitrary file reading. An attacker can upload a malicious file to trigger this vulnerability.
TALOS-2025-2306 (CVE-2026-30818) is an OS command injection vulnerability exists in the dnsmasq configuration restore dhcpscript functionality of Tp-Link Archer AX53 v1.0 1.3.1 Build 20241120 rel.54901(5553). A specially crafted configuration value can lead to arbitrary command execution. An attacker can upload a malicious file to trigger this vulnerability.
TALOS-2025-2307,TALOS-2025-2308, andTALOS-2025-2309 are OS command injection vulnerabilities in the OpenVPN configuration restore client_disconnect, client_connect, and route_up functionalities of Tp-Link Archer AX53 v1.0 1.3.1 Build 20241120 rel.54901(5553). A specially crafted configuration value can lead to arbitrary command execution. An attacker can upload a malicious file to trigger this vulnerability.
Photoshop vulnerabilities
Discovered by KPC of Cisco Talos.
Adobe Photoshop is a popular digital photo manipulation and illustration program with a wide array of features for personal and business use cases.
TALOS-2025-2274 (CVE-2026-34632) is a privilege escalation vulnerability in the installation process of Adobe Photoshop via the Microsoft Store. The vulnerable version of the installer is Photoshop_Set-Up.exe 2.11.0.30. A low-privilege user can replace files during the installation process, which may result in elevation of privileges.
OpenVPN vulnerabilities
Discovered by Emma Reuter of Cisco ASIG.
OpenVPN is an open source SSL VPN with remote access, site-to-site VPNs, WiFi security, enterprise load balancing, failover, and granular access control features available.
TALOS-2026-2381 (CVE-2026-35058) is a reachable assertion vulnerability in the TLS Crypt v2 Client Key Extraction functionality of OpenVPN 2.6.x and 2.8_git. A specially crafted network packet can lead to a denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability.
Gen Digital Norton VPN vulnerabilities
Discovered by KPC of Cisco Talos.
Gen Digital’s Norton VPN client is a proprietary tool for private proxy network information exchange.
TALOS-2025-2276 (CVE-2025-58074) is a privilege escalation vulnerability in the installation process of Norton VPN via the Microsoft Store. A low-privilege user can replace files during the installation process, which may result in deletion of arbitrary files, possibly leading to elevation of privileges.
While many companies are intentionally rolling out AI to boost quality and efficiency, unsanctioned AI tools are cropping up in corporate environments even faster. Software vendors are baking AI right into products companies already use (think Microsoft Copilot and Google Gemini), while employees are taking matters into their own hands and installing tools on the sly. As a result, businesses are staring down a poorly managed data leak channel: staff paste information from corporate systems into AI chatbots, sending data not just to the SaaS vendor, but straight to the developers behind the underlying AI model. Both the risks and the mitigation strategies vary depending on the type of AI system in play. We break down this broad topic, focusing heavily on tools for spotting and blocking AI at two distinct levels.
Types of unwanted AI systems
Depending on the type of AI in question, managing and blocking its use requires a different playbook. It’s essential to break down AI into four distinct categories:
Platform-native AI capabilities. Think Microsoft Copilot, Google Gemini, and Apple Intelligence, along with AI features baked right into browsers. The tricky thing about these is that they’re built into everyday essentials, are instantly available to every user (sometimes popping up aggressively), and most importantly, vendors try to turn them on by default.
AI companions embedded in business apps. This bucket includes Slack AI, Zoom AI Companion, Notion AI, Jira’s Rovo assistant, and the like. These are tied to a single application and are completely inseparable from it.
Standalone web and app-based chatbots. ChatGPT, Claude, Perplexity, Character AI, local setups like LM Studio, browser extensions, and agentic browsers like Comet. Apps and services in this category are usually adopted by employees on their own without permission: classic examples of shadow AI.
Desktop-native multi-functional agents. This group features tools like OpenClaw, NanoClaw, NemoClaw, and others. They pose the biggest threat because they come with broad access rights by default and actively process untrusted data from the open web.
How to deal with unwanted AI
Every company, depending on its industry, appetite for innovation, and risk tolerance, needs to draw its own line in the sand between recommended, approved case-by-case, and completely banned use cases for specific AI products. Regulated sectors like healthcare play by one set of rules, while retail businesses operate under an entirely different playbook. Either way, after analyzing exactly which AI tools have already slipped into the organization, corporate policies need to be fine-tuned. That’s why the first order of business is employing existing infosec and logging tools to scan corporate infrastructure.
Depending on the chosen strategy, the uncovered AI systems can be:
Disabled or restricted by using the built-in corporate policy settings within the tools themselves
Hard-blocked at the endpoint or network level to create a safety net against policy workarounds or configuration errors
Transitioned to managed access, where the tool isn’t completely blocked but instead routed through a dedicated corporate gateway that checks access permissions, and monitors usage patterns
Detecting AI systems
Spotting AI requires a multi-layered approach, as different detection methods complement each other and work best against specific types of AI.
Technology
What it can detect
DNS
Any AI tool with an identifiable domain
Web Gateway or NGFW
Any AI tool with a recognizable request-and-response fingerprint (API endpoint paths, domains, and other indicators). Web filters can inspect traffic content, and many gateways/NGFWs now feature a dedicated category for detecting and blocking generative AI
EPP/EDR
Locally deployed LLMs (running via Ollama, LM Studio, and similar shells), native desktop apps for ChatGPT or Claude, agentic browsers, and open-source AI agents. An indirect but strong red flag is the presence of Node.js, Python, Git, Docker, or other containerization tools on machines belonging to non-technical staff
Application control
Similar to EPP/EDR, this allows to immediately block unwanted applications right out of the gate
Browser control
AI-focused browser extensions and visits to AI-themed websites. This is a lifesaver if the corporate web gateway can’t inspect encrypted traffic
OAuth permissions requested by AI apps and services, as well as any third-party integrations plugging into core productivity hubs (Microsoft 365, Google Workspace, and others)
Naturally, almost all of these tools allow to do more than just spot AI — they let to block it entirely, or at the very least, sound the alarm for the team in charge.
Keeping an eye on OAuth
Popular office AI solutions — especially meeting assistants, email and calendar automation agents, and the like — gain access to corporate data by requesting OAuth permissions directly from communication, document workflow, or video conferencing platforms. If a user has the green light to grant these permissions to third-party apps, the resulting data leaks completely bypass the organization’s perimeter. Tools like EDR and NGFW won’t see a thing when a tool like Read.ai grabs recordings of every single meeting in, say, Microsoft Teams.
The most drastic — and often best — move is to block standard users from granting OAuth consent in the first place. Here’s how to handle the technical heavy lifting (Global Administrator, Application Administrator, or equivalent rights are needed):
Microsoft 365 / Entra ID
In the Microsoft Entra admin center, head over to <em>Identity > Applications > Enterprise apps > Consent and permissions > User consent settings</em>. There <em>User consent for applications</em> can be disabled (check out Microsoft’s full guide).
Google Workspace
In the Google Admin console, navigate to <em>Security > Access and data control > API controls</em>. Under <em>Manage App Access</em>, the trust level for all apps can be set: <em>Trusted</em>, <em>Limited</em>, <em>Specific Google data</em>, or <em>Blocked</em>. However, the real kicker here is the <em>Unconfigured app settings</em> subsection, which dictates what happens when a user tries to connect an unknown app. To seal this loophole, select <em>Don’t allow users to access any third-party apps</em>.
A separate subsection, <em>Manage Google Services</em>, permits fine-tuning exactly how third-party apps interact with Google Workspace and Google Cloud services. This allows to cut off access for each individual Google product (see Google’s official guide).
Salesforce
In <em>Setup</em>, use the <em>Quick Find</em> box to search for connected apps, then select <em>Manage Connected Apps</em> from the results. While settings are configured for each external app individually, all users can approve access by default. There isn’t a blanket block switch here; instead, Salesforce allows to opt for <em>Admin approved users are pre-authorized</em> (see the full Salesforce guide on this).
Slack
From the <em>Admin</em> settings menu, head to <em>Apps and workflows -> App Management Settings</em>. Tweak the <em>Require approved apps</em> setting by selecting <em>Only allow pre-approved apps</em>. Once that’s locked in, double-check that no rogue AI tools have slipped onto the approved list.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-05-19 16:06:342026-05-19 16:06:34Tools for spotting and disabling AI systems in an enterprise
Have you ever tried to tally up how much you spend on subscriptions each month? Music, movies, gaming, language courses, delivery services, heated seats, and even the ability to chat with the Grok bot directly from your car — there’s a subscription for just about everything now. There’s even a subscription service specifically designed to… track your other subscriptions.
The number of subscriptions varies significantly depending on where you live, but statistically, 78% of adults worldwide have at least one paid subscription, with the average user juggling 5.6 active services. Furthermore, a large portion of these are family plans used by groups of close relatives… and sometimes other people: 37% of users share their subscriptions outside their immediate family.
Because subscription accounts, especially family plans, often contain sensitive personal data, they’ve become a prime target for cybercriminals. Today we look at how to manage your subscriptions securely, avoid having your accounts compromised, and keep from falling for scammers’ latest tricks.
Security of shared accounts and subscriptions
Why would anyone want to hack your subscription? Even if the service only offers entertainment, your account almost certainly contains sensitive information: your name, address, email, phone number, the names of other members, and other personally identifiable information. This data is then sold on the dark web and used for further attacks.
Attackers compromise subscription accounts either through social engineering and phishing, or by taking advantage of many users’ reliance on weak or leaked passwords. As we recently highlighted in our research, nearly half of all passwords worldwide can be cracked in less than a minute. Scammers then either resell existing subscriptions or slots in a family group at a discount, or they sign the victim up for new services, hoping the extra charges go unnoticed.
Finally, some middlemen don’t bother with hacking at all; they simply buy bulk subscriptions for a large number of devices, where the per-unit cost is typically much lower. They then resell individual slots in these plans on online marketplaces. As a result, a single “family” account can end up filled with people who are complete strangers to one another.
Sharing subscriptions with family and others
Many subscription owners think nothing of sharing access with family and friends. What could possibly go wrong?
The worst-case scenario from a security standpoint is when a single account is purchased and the owner shares the login and password with other users. This usually happens when people try to save money on a family plan by buying an individual subscription and sharing it. Some services even allow for different profiles, but they are all tied to a single account, meaning the credentials are shared. This is how streaming platforms like Hulu and Disney+ operate.
Sharing one account among multiple people significantly increases the risk of your credentials falling into the wrong hands. There’s no way to guarantee that everyone else is storing those details securely or that their devices aren’t infected with malware. Even without malware, it’s incredibly easy to accidentally hand over a password to attackers simply by signing in to the subscription service over unprotected public Wi-Fi.
It’s entirely possible that the password you kindly shared with some friends has already surfaced in some corner of the dark web, and you may soon lose access to your account. Furthermore, if you reuse the same password across different sites and apps, your other accounts are now in the crosshairs as well.
The second scenario is when each group member has an individual account. Many services now allow you to add extra users to a subscription at no additional cost, and most owners are happy to give away these free slots. Even then, you shouldn’t let your guard down: a breach of just one of these accounts can still leak sensitive information, such as family members’ names, addresses, billing info, and other subscription-related data.
How to protect your subscriptions (and your wallet)
To keep your and your loved ones’ personal data private and your accounts under your control, follow these simple rules.
Use strong account security
To do this, learn — and teach your friends and family — how to use password managers, two-factor authentication, or passkeys.
If you and your loved ones rely on memory to store passwords, there’s a high probability that you’re reusing the same one across multiple services. This is a major blunder: data breaches happen all the time, and a single compromised password gives attackers access to your other accounts.
The simplest solution is to use a password manager that generates and remembers complex, unique passwords for every site and service on your behalf. All you have to do is remember the single main password for its encrypted vault. Additionally, Kaspersky Password Manager doesn’t just store and create passwords; it can also check if they’ve appeared in leaked databases, and sync your credentials across all your devices.
Additionally, a password manager provides a robust defense against phishing: unlike a human, who can easily be misled by a sign-in form that looks almost identical to the real thing and is hosted on a look-alike domain, a password manager won’t fall for the trick. It’ll only offer to autofill your saved login and password on the specific site or service for which they were originally stored.
Two-factor authentication (2FA) is an extra layer of verification the system requests after you enter your password — such as an SMS code or a one-time code from an authenticator app. Whenever technically possible, be sure to enable 2FA on every account linked to a subscription. This applies to the subscription services themselves, as well as any third-party accounts you use to sign in, such as Google, Apple, or Facebook.
We recommend storing your two-factor authentication tokens and generating the one-time codes — which refresh every 30 seconds — inside Kaspersky Password Manager. This significantly lowers the chances of someone hijacking your account. Even if an attacker somehow discovers or guesses your password, they won’t be able to get the code without physical access to your device.
Finally, you can ditch passwords (almost) entirely by switching to passkeys. We’ve previously covered what this password alternative looks like and the specifics of using it. Currently, this is the most breach-resistant authentication system out there. Its main drawback has been the difficulty of syncing passkeys across different ecosystems, like Windows and iOS, but the updated version of Kaspersky Password Manager can now save and sync passkeys across Windows, macOS, iOS, and Android devices, making that issue a thing of the past.
Don’t overlook device security
Even a complex password and 2FA aren’t reasons to let your guard down. An attacker can infect your device with an infostealer: malware designed to swipe things like session cookies from your browser, app configuration files, and other sensitive data. Session cookies allow you to stay signed in without re-entering your credentials every time; however, if scammers get their hands on them, they can sign in to the service as you — even without knowing your username or password. This makes a proactive approach essential, especially if you use Chrome, Edge, Opera, or other Chromium-based browsers on Windows. We recommend installing Kaspersky Premium on all your devices; it includes Kaspersky Password Manager in addition to comprehensive protection against cyberthreats.
Only share subscriptions with people you trust
Otherwise, you might be asking for trouble. For example, if you share a Steam subscription with a friend who cheats, both of your accounts could end up banned. Furthermore, never try to let someone else into your personal account or individual subscription. Sharing your password with others is usually a violation of the terms of service, and can result in your account being blocked.
Make sure there are no strangers in your family group
To do this, periodically check active devices and sessions in your subscription settings. If you see an unrecognized device in the authorized list, terminate that session — or all of them — and change your account password immediately. Signing back in on a few devices is much easier than trying to recover a hijacked account.
And remember: don’t let your own habits compromise your security. If you’re visiting friends, on vacation, or on a business trip and use a local computer or smart TV — or if you sign in to your account from a public computer — don’t forget to sign out when you’re done. Otherwise, the next person to use that device might find themselves with free subscriptions or, even worse, access to your email or cloud photo stream.
Don’t take the bait
Watch out for phishing emails and messages spoofing legitimate services. If you receive a notification about a “need to update your billing details”, or a claim that a “new user has been added” to your family plan, don’t rush to click any links or open attachments. Links can lead to a phishing page, and attachments may hide malware. Scammers often use email addresses and domains that look nearly identical to the real ones — for instance, by swapping l (lowercase L) for I (uppercase i), or using a familiar name in a different domain zone.
Unfortunately, phishing pages are often indistinguishable from the originals now that AI is being used for high-quality design and layout. Since spotting every red flag yourself is increasingly difficult, it’s best to delegate anti-phishing protection to Kaspersky Premium. It will alert you to suspicious sites, saving your money and keeping your peace of mind.
Lastly, some scammers lure users in with freebies like fake gift subscriptions for Telegram Premium. The victim is asked to visit a phishing page mimicking the Telegram login screen and sign in to their account to claim the gift. The result isn’t hard to guess: instead of a premium subscription — a hijacked account. Recently, scammers have even learned to use mini-apps to steal credentials directly inside Telegram under various pretexts — ranging from gift giveaways to claims that you must move to a new chat because the old one was blocked.
Avoid buying subscriptions from third-party sellers
You can often find subscription offers on marketplaces and retail platforms at prices significantly lower than what the official provider charges. More likely than not, that tempting price hides a hacked account or a family group that you could be kicked out of at any moment, because the family admin is either the seller or a random user. Furthermore, sharing a family plan with strangers from around the world is a violation of terms for many services.
How to get rid of unwanted subscriptions
Now that we’ve covered subscription security, what about those extra subscriptions that quietly eat away at your balance every month? Research shows that users typically underestimate how many active subscriptions they have and how much they spend on them; they also frequently forget to cancel auto-renewals for subscriptions they no longer use, or auto-charges after the trial period ends.
If you suspect you’re in that boat, start your investigation with your own bank statements. Recurring charges for the same amount can be a subscription you’ve forgotten about. Check who received the payment; if the name doesn’t ring a bell, do an online search on the company. It’s also worth searching your email box for the merchant name or the payment amount; this can help you track down subscription notifications and figure out what exactly you’re paying for. And don’t forget to check your spam folder, as that’s where subscription alerts often end up.
Now, let’s look at how to check and cancel active subscriptions purchased through the App Store and Google Play.
For Android users
Open Settings on your device.
Tap Google, then tap your profile picture, and go to Google Account.
Go to Wallet & subscriptions.
If you’re the family group manager, you’ll be able to see the purchase history for other family members.
For iOS users
Open Settings on your device.
Tap your profile picture at the top of the menu.
Go to Subscriptions.
Note: to manage your iCloud subscription, you’ll need to go to the specific iCloud section located just below Subscriptions. In the Family Sharing section, if you’re the one who set it up, you can view the subscription and purchase history for all family members.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-05-19 12:06:362026-05-19 12:06:36How to manage subscriptions securely | Kaspersky official blog
Your employees are not falling for “bad grammar” phishing anymore. They are being pulled into fake Microsoft logins, banking pages, AI tool instructions, real OAuth flows, and event invitations that look close enough to daily work to pass without alarm.
For CISOs, that is the real social engineering problem in 2026: attacks are no longer easy to separate from normal business activity. And when the SOC cannot quickly see what happened after the click, every investigation becomes a race against exposure.
The New CISO Problem: Social Engineering That Looks Like Business as Usual
Modern social engineering attacks are harder to stop because they no longer rely only on suspicious attachments or poorly written emails. They copy the workflows employees use every day.
For CISOs, this leads to difficult operational issues. The SOC may detect a suspicious link, page, or login attempt, but still lack the full context to understand whether the incident led to credential theft, token abuse, remote access, or exposure of business-critical systems.
That creates several problems at once:
Too many gray-zone alerts that require manual validation
Slow confidence during triage because the activity looks close to legitimate work
Context gaps between Tier 1, Tier 2, and IR teams
Delayed prioritization when the business impact is unclear
Higher pressure on senior SOC resources due to unnecessary or poorly prepared escalations
Limited executive visibility into whether the incident is a minor phishing attempt or a real access risk
This is why modern social engineering is a visibility, escalation, and decision-making problem for the entire security operation.
Turn unclear phishing alerts into confident SOC decisions.
Use interactive analysis to validate risks faster.
1. Fake Microsoft Login Pages Still Work Because They Abuse Daily Business Habits
Fake Microsoft login pages remain one of the most common social engineering tactics because they imitate a workflow employees already trust: opening a shared file, checking email, accessing OneDrive, or signing into Microsoft 365.
Fake Microsoft login page exposed inside ANY.RUN sandbox
For security leaders, the concern is that this attack still hits one of the most valuable parts of the business: identity. Microsoft accounts often connect employees to email, files, SaaS tools, internal conversations, customer communication, and partner access. Once one account is compromised, the impact can quickly move beyond a single inbox.
CISO blind spot: The SOC may treat a fake login page as a simple phishing event, while the real business risk may be account takeover, email compromise, or lateral movement through connected cloud services.
2. Banking Phishing Turns Employee Trust into Financial Exposure
Banking-themed phishing attacks are especially risky because they target workflows employees may already treat as urgent: payment alerts, transaction issues, account notices, invoices, or financial document requests.
In the BlobPhish campaign observed by ANY.RUN, attackers impersonated major financial and cloud services, including Chase, Capital One, FDIC, E*TRADE, Schwab, Microsoft 365, OneDrive, and SharePoint. The campaign used phishing pages that appeared directly inside the browser, making them harder for traditional tools to detect through normal URL, file, or network visibility.
Phishing pseudo-MS365 page loaded as a blob object
The danger is that these lures touch systems tied to money, approvals, vendors, customer data, and cloud access. A single captured credential can open the door to payment fraud, mailbox abuse, partner-facing scams, or sensitive data exposure.
CISO blind spot: A banking phishing lure may look like a narrow credential-theft attempt, but in a corporate environment, it can expose financial operations, cloud accounts, partner communication, and sensitive business data.
3. ClickFix Attacks Abuse Employee Trust in AI Tools
ClickFix attacks are becoming more dangerous as employees rely on AI tools for coding, research, automation, and daily productivity. Instead of sending a suspicious attachment, attackers imitate the tools people already use and guide them through actions that feel like normal setup or troubleshooting.
In one ANY.RUN case, attackers used fake documentation pages for popular AI tools, including Claude Code and Grok. The victim was prompted to run a command that appeared to be part of the installation or configuration process. In reality, that action launched a malware infection on macOS.
Multi-OS attack: malicious terminal commands for various platforms
This tactic is especially risky because it targets high-value users. Developers, product teams, finance employees, and executives often use Macs and AI tools, and they may also have access to source code, cloud environments, financial systems, customer data, or internal documents.
CISO blind spot: ClickFix attacks may not look like a traditional phishing incident. The user is not opening a strange attachment. They are following instructions from what appears to be a trusted AI tool page. That makes the attack harder to catch early and easier to underestimate until credentials, session data, or endpoint access are already exposed.
Close the visibility gap around business-critical users.
Protect the teams and systems attackers target first.
4. OAuth Device Code Phishing Turns Legitimate Microsoft Login into an Access Risk
OAuth device code phishing is dangerous as it does not follow the usual fake-login-page pattern. The victim is sent to a real Microsoft verification page, enters a code, completes authentication, and may even pass MFA.
In the EvilTokens campaign observed by ANY.RUN, attackers abused Microsoft’s OAuth Device Code flow to get access tokens without directly stealing the user’s password. More than 180 phishing URLs were detected in one week, showing how quickly this technique can spread across Microsoft 365 environments.
This makes the attack harder to recognize as phishing. From the user’s side, the process looks legitimate. From the security team’s side, the activity may blend into normal authentication traffic until the account is already exposed.
CISO blind spot: OAuth device code phishing may not trigger the same warning signs as a fake login page. The user authenticates through Microsoft, but the attacker receives the token. That can lead to Microsoft 365 account takeover, mailbox access, cloud data exposure, and delayed response because the compromise does not look like classic credential theft.
5. Fake Invitations Turn Simple Lures into Access Risk
Fake invitation phishing works because it feels harmless. An event invite, a CAPTCHA check, and a sign-in page can look like a normal online workflow, especially when employees are used to opening meeting links, webinars, vendor invitations, and shared business events.
In a U.S.-targeted campaign analyzed by ANY.RUN, attackers used fake event invitation pages to push victims toward credential theft, OTP interception, or remote management tool installation. Some pages collected email credentials and one-time codes, while others delivered legitimate RMM tools such as ScreenConnect, ITarian, Datto RMM, ConnectWise, and LogMeIn Rescue.
Fake invitation used as a lure, exposed inside ANY.RUN sandbox
That makes the campaign harder to judge quickly. The same type of lure can lead to different outcomes: stolen mailbox access, intercepted MFA codes, or remote access inside the environment. For the SOC, this creates a gray-zone investigation where several small signals need to be connected before the real risk becomes clear.
CISO blind spot: A fake invitation may look like a low-priority phishing page, but it can become an access problem fast. If the SOC cannot quickly see whether the page led to credential theft, OTP capture, or RMM installation, response may start only after exposure has already grown.
Don’t let trusted login flows hide real compromise.
Give your SOC clearer evidence.
How CISOs Can Close These Social Engineering Blind Spots
The hardest part of modern social engineering response is often not spotting something suspicious. It is proving what happened next fast enough to make the right decision.
A suspicious email, link, page, or file may be detected, but the SOC still needs to answer the questions that determine the real risk: Did the user submit credentials? Was MFA or OAuth abused? Was remote access delivered? Did the activity reach an endpoint? Does this require escalation, containment, or leadership attention?
To close this gap, social engineering investigations need to move through a clearer workflow:
1. Validate the threat before it becomes a bigger incident
When a suspicious email, link, file, or phishing page reaches the SOC, the priority is not only to label it as malicious or benign. The team needs to understand what the object actually does and how far the activity could go if left unchecked.
Phishing sample analyzed inside ANY.RUN sandbox
ANY.RUN’s Interactive Sandbox lets teams safely open the suspicious object and observe the full behavior in real time: redirects, fake login pages, OTP prompts, file downloads, remote access activity, and concealment attempts. Instead of guessing from isolated alerts, the SOC can see and interact whenever needed.
This gives teams earlier certainty during the most critical stage of triage. They can confirm the real risk faster, decide whether the case needs escalation, and reduce the chance that a “small” social engineering alert becomes a larger business incident.
2. Turn investigation results into evidence the whole SOC can use
Even when the attack is visible, teams still need to communicate the findings clearly. Raw telemetry can slow down handoffs, create context loss, and make it harder for managers to understand severity.
With Tier 1 Reports and AI Summary inside the sandbox, findings become structured, SOC-ready context: what happened, why it matters, what evidence supports escalation, and where the team should focus next.
This gives teams several practical benefits:
Faster triage because Tier 1 gets a clear threat overview without manually rebuilding the attack story
Cleaner escalations as Tier 2 and IR receive context, not just raw indicators
Less context loss when the case moves between teams or shifts
More consistent reporting across analysts and incidents
Clearer management visibility into severity, exposure, and required next steps
Better response decisions because teams can act on confirmed behavior, not assumptions
This way, social engineering investigations do not stop at “we found suspicious activity.” They become ready-to-use evidence for prioritization, escalation, containment, and leadership reporting.
Clarity for analysts. Visibility for decision-makers. Faster response across your SOC.
3. Understand whether the case is isolated or part of a wider campaign
After the behavior is confirmed, the next question is scope. Is this one phishing attempt, or part of a broader campaign targeting similar companies, industries, or regions?
With ANY.RUN Threat Intelligence, teams can pivot from one case to related domains, IOCs, URL patterns, infrastructure, and similar sandbox sessions. This gives the SOC broader context for detection, hunting, and prioritization, so teams are not making decisions from one alert alone.
Relevant sandbox sessions displayed inside ANY.RUN’s TI Lookup for better context and deeper analysis
For security leaders, this creates a stronger operating model for social engineering response:
Earlier risk confirmation before credential theft, token abuse, or remote access turns into a larger incident
Better campaign awareness when one suspicious case is connected to related infrastructure and repeated attack patterns
Stronger SOC consistency because investigations follow the same process instead of depending on individual experience
Improved resource allocation as senior teams focus on cases with confirmed exposure, not unclear alerts
More defensible incident decisions based on visible behavior, threat context, and structured reporting
Clearer business-risk communication when leaders need to understand what happened, what is exposed, and what happens next
This turns social engineering response into a repeatable process: observe the attack, enrich the context, document the findings, and act before exposure spreads.
From Social Engineering Visibility to SOC Performance
Closing social engineering blind spots is about reducing the operational drag these attacks create across the SOC: unclear alerts, manual validation, repeated handoffs, and delayed decisions.
Boosting SOC performance with ANY.RUN’s sandbox analysis and threat intelligence solutions
Organizations using ANY.RUN report:
21 minutes faster MTTR per case, helping reduce the time between detection and containment
94% faster triage reported by users during suspicious file, URL, and phishing investigations
30% fewer Tier 1 to Tier 2 escalations, helping protect senior team capacity
Up to 20% lower Tier 1 workload by reducing manual investigation effort
Up to 3x stronger SOC efficiency across validation, enrichment, escalation, and response workflows
These results show the practical value of closing social engineering blind spots: fewer delays, less wasted effort, and faster confidence when the business needs a clear answer.
Reduce the delay between detection and confident action.
Give your SOC the context to respond before exposure spreads.
ANY.RUN delivers cybersecurity solutions built to support real-world SOC operations. Its platform helps security teams investigate threats faster, make informed decisions, and apply threat intelligence across detection, triage, response, and reporting workflows.
The company’s solutions include the Interactive Sandbox for enterprise-grade malware and phishing analysis, as well as ANY.RUN Threat Intelligence solutions, including TI Lookup, TI Feeds, TI Reports, and YARA Search. Together, they provide fresh, behavior-based intelligence built on live attack analysis.
ANY.RUN is SOC 2 Type II attested, reflecting strong security controls and a commitment to protecting customer data. For SOCs, MSSPs, and enterprise security teams, ANY.RUN helps reduce investigation uncertainty, improve triage speed, and turn complex threat activity into clear, actionable evidence.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2026-05-19 12:06:352026-05-19 12:06:35Top 5 Phishing-Driven Social Engineering Attacks on Companies in 2026
