Using ANY.RUN to Investigate SharePoint-Impersonation Phishing

Summary

A sponsored ANY.RUN walkthrough investigates phishing domains impersonating Microsoft SharePoint, showing how domain-pattern searches and sandbox analysis reveal credential harvesting and support threat hunting.

Key points

The report discussed in the video describes rising activity from domains impersonating Microsoft SharePoint between June 26 and July 9, 2025.
The presenter identifies recurring domain structures, including a fixed “mysharepoint” segment and variable numeric characters, and demonstrates regex searches to find related domains.
The walkthrough pivots from indicators in ANY.RUN Threat Intelligence Lookup to sandbox tasks and process graphs to examine observed behavior.
The video says attackers abused the legitimate Alboom Pro platform to host phishing content.
One sandbox example shows a document click leading to a malicious SharePoint page that harvested credentials; the presenter says that sample did not drop files on the host.
The report says some campaigns may bypass multifactor authentication; the video recommends using observed behaviors, not just static indicators, to inform detections and hunts.

Article Details

Topics: [00:00] Reported SharePoint-impersonation phishing trends and claimed MFA bypass
[01:40] Reviewing phishing-domain examples and recurring naming structures
[05:04] Using regex patterns to search for related domains
[08:01] Pivoting from static indicators to sandbox behavior
[09:47] Examining hosted phishing content and credential harvesting
[12:04] Applying behavioral findings to detection and threat hunting

Indicators of compromise

Type	Indicator	Context
DOMAIN	`capernos[.]com`	Listed as an observed domain in the phishing-domain examples; the presenter describes the examples as involving typosquatting.
DOMAIN	`handyman[.]pro[.]com`	Domain shown in an observed phishing flow that led to a malicious SharePoint page used for credential harvesting.