ANY.RUN Details Six Business-Themed Phishing and Malware Campaigns From May 2026
Summary
ANY.RUN’s May 2026 roundup describes six campaign patterns, including fake invitations, Agent Tesla document lures, OTP phishing, fileless delivery from compromised B2B sites, ScreenConnect remote-access chains and BlobPhish browser-based credential theft.
Key points
- ANY.RUN reported fake invitation phishing targeting U.S. organizations, with potential credential theft, OTP interception and remote-access tool delivery.
- An Agent Tesla campaign used purchase orders, invoices, payroll files and procurement requests to target enterprises in Latin America.
- Attackers abused compromised B2B websites and injected scripts to lead users toward PowerShell execution, in-memory payloads and C2 communication.
- A campaign impersonating a U.S. financial institution collected usernames, passwords, OTP codes and email verification data; ANY.RUN identified hundreds of related phishing domains.
- A fake Word Online/OneDrive-style page reportedly led users through software installation to ScreenConnect remote access.
- BlobPhish generated phishing pages in the browser using blob objects to target Microsoft 365, financial institutions and webmail services.
Article Details
- Event Type
- Multiple phishing, credential-theft, fileless malware-delivery, and remote-access campaigns reported by ANY.RUN in May 2026.
- Impact
- The campaigns targeted organizations and users through fake invitations, business-document lures, compromised B2B websites, OTP phishing, and fake document pages. Reported risks included credential and OTP theft, possible account takeover, PowerShell and in-memory execution, and remote access through ScreenConnect. ANY.RUN reported that the OTP campaign used hundreds of related phishing domains, but the article provides no specific IOC values.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article describes browser-generated blob pages and in-memory payloads that concealed malicious content.T1055 · Process InjectionProcess injection is mentioned as part of the reported fileless activity.T1056.003 · Web Portal CapturePhishing pages collected usernames, passwords, OTP codes, and email verification data.T1059.001 · PowerShellPowerShell execution was part of the reported fileless delivery chain from compromised websites.T1105 · Ingress Tool TransferPhishing chains could deliver remote access tools and installers.T1204.002 · Malicious FileThe article describes business-themed files, including invoices and purchase orders, as lures that relied on user interaction.T1219 · Remote Access ToolsA fake document-access chain led to remote access through ScreenConnect; the article also describes RMM deployment.T1556.004 · Network Device AuthenticationThe reported phishing campaigns intercepted OTPs in real time to bypass MFA.T1566.002 · Spearphishing LinkFake invitation flows, banking portals, and document lures directed users to phishing pages.
Malware
Vendors
Products
Microsoft 365 Apps for EnterpriseBlobPhish used browser-generated blob objects to hide Microsoft 365 and webmail credential theft from traditional visibility controls.Microsoft OneDriveFake Word Online / OneDrive pages redirected users into a ScreenConnect-based remote access chain disguised as document access.OutlookAnother May attack started with an Outlook email and redirected users to a fake Word Online / OneDrive-style page.ScreenConnect#ANY.RUNWord OnlineFake Word Online / OneDrive pages redirected users into a ScreenConnect-based remote access chain disguised as document access.
Countries
Industries
Banking[T1566.002] Phishing: Spearphishing Link – Used fake invitation flows, banking portals, and document lures to send victims to credential-harvesting pages [‘users followed an invitation that felt familiar’; ‘redirectedEducationFinance, banking, healthcare, manufacturing, technology, education, and government.financeAn Agent Tesla campaign used business-document lures against Latin American enterprises, putting finance, procurement, and payroll credentials at risk.GovernmentFinance, banking, healthcare, manufacturing, technology, education, and government.HealthcareFinance, banking, healthcare, manufacturing, technology, education, and government.ManufacturingFinance, banking, healthcare, manufacturing, technology, education, and government.TechnologyFinance, banking, healthcare, manufacturing, technology, education, and government.