ANY.RUN’s March 2026 Roundup Details OAuth Phishing, ClickFix and More
Summary
ANY.RUN’s March 2026 roundup describes threats including OAuth token phishing, macOS ClickFix delivering AMOS Stealer and a backdoor, registry-staged OrcusRAT, Magecart skimming, SVG phishing, DDoS botnets and MicroStealer.
Key points
- ANY.RUN analysts reported that the EvilTokens campaign used Microsoft OAuth Device Code flow to obtain tokens without stealing passwords; they detected more than 180 phishing URLs in one week.
- A macOS ClickFix campaign used fake Claude Code documentation pages to deliver AMOS Stealer and an updated ~/.mainhelper backdoor with an interactive WebSocket reverse shell.
- RUTSSTAGER stored a hex-encoded DLL in the Windows registry and led to OrcusRAT deployment, with an additional component for persistence and relaunch.
- Phishing attachments disguised as PDFs and a campaign targeting Colombian organizations used staged lures, including SVG-generated HTML and password-protected ZIP files.
- ANY.RUN described a Magecart campaign that hijacked checkout flows and exfiltrated card data over WebSocket, using more than 100 domains and remaining active for over 24 months.
- Kamasers supported HTTP, TLS, UDP, TCP and GraphQL-based DDoS attacks, and used public services to retrieve command-and-control addresses; analysts also observed it downloading additional files.
- MicroStealer appeared in more than 40 sandbox sessions in under a month, using an NSIS, Electron and Java chain to collect credentials, session data, screenshots and wallet files.
Article Details
- Event Type
- A roundup of cyber campaigns observed in March 2026, including OAuth device-code phishing, macOS malware delivery, registry-based RAT deployment, credential phishing, SVG smuggling, payment skimming, DDoS activity, and infostealer infections.
- Impact
- Reported risks included Microsoft 365 account takeover through OAuth token abuse; theft of credentials, browser data, payment-card data, and other sensitive files; persistent remote access; DDoS-related disruption; and potential follow-on malware delivery. The article describes increased fraud, downtime, and response costs, but does not report a confirmed aggregate number of victims or losses.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | ab-monvoisinproduction-com-s-account[.]workers[.]dev | Listed as EvilTokens phishing infrastructure used in the OAuth device-code phishing campaign. |
| HOSTNAME | dibafef289[.]workers[.]dev | Listed as EvilTokens phishing infrastructure used in the OAuth device-code phishing campaign. |
| HOSTNAME | sandra-solorzano-duncanfamilyfarms-net-s-account[.]workers[.]dev | Listed as EvilTokens phishing infrastructure used in the OAuth device-code phishing campaign. |
| HOSTNAME | singer-bodners-bau-at-s-account[.]workers[.]dev | Listed as EvilTokens phishing infrastructure used in the OAuth device-code phishing campaign. |
| HOSTNAME | subzero908[.]workers[.]dev | Listed as EvilTokens phishing infrastructure used in the OAuth device-code phishing campaign. |
| HOSTNAME | tyler2miler-proton-me-s-account[.]workers[.]dev | Listed as EvilTokens phishing infrastructure used in the OAuth device-code phishing campaign. |
| SHA256 | 07f56ac8b5bd7cdb4c33ea5e9cd42bc7f9d3cd5504aabbb476ef010a142d7e29 | Hash listed among RUTSSTAGER and registry-stored DLL artifacts. |
| SHA256 | 57ce6187be65c1c692a309c08457290ae74a0047304de6805dbb4feb89c0d7e5 | Hash listed among RUTSSTAGER and registry-stored DLL artifacts. |
| SHA256 | 6a581c3b6fe7847bb327f5d76e05653a1504e51023454c41835e5dc48bc13ba4 | Hash listed among RUTSSTAGER and registry-stored DLL artifacts. |
| SHA256 | 7d157366d74312965912a35cbba4187532cfeb3b803119a3a04c9ba0ba7d4ab0 | Hash listed among RUTSSTAGER and registry-stored DLL artifacts. |
| SHA256 | a6f72590792b3f26271736e5a7ba80102292546bb118cf84ff29df99341abfbe | Hash listed among RUTSSTAGER and registry-stored DLL artifacts. |
MITRE ATT&CK
T1059.001 · PowerShellThe RUTSSTAGER infection chain includes PowerShell-based system checks.T1102.001 · Dead Drop ResolverKamasers uses a Dead Drop Resolver design to retrieve C2 addresses from public services.T1112 · Modify RegistryRUTSSTAGER stores a DLL in the Windows registry in hexadecimal form.T1204.004 · Malicious Copy and PasteIn the macOS ClickFix campaign, users are induced to run a terminal command that starts the infection chain.T1498 · Network Denial of ServiceKamasers is described as a multi-vector DDoS botnet carrying out application-layer and transport-layer attacks.T1528 · Steal Application Access TokenThe EvilTokens campaign abuses OAuth Device Code flow to obtain OAuth tokens for access to Microsoft 365 resources.
Malware
Atomic macOS Stealer (AMOS)campaigns that exploited trusted workflows—OAuth Device Code phishing, macOS ClickFix delivering AMOS Stealer and backdoors, registry-hidden DLL staging leading to OrcusRAT, Magecart payment skimming, SVGKamasersKamasers is a resilient multi-vector DDoS botnet with Dead Drop Resolver design using public services (GitHub Gist, Telegram, Dropbox, Bitbucket, Etherscan) to retrieve C2, and it can also act as a loader for follow-onMicroStealer8. MicroStealer: A Fast-Spreading Infostealer with Limited Detection OrcusRATphishing, macOS ClickFix delivering AMOS Stealer and backdoors, registry-hidden DLL staging leading to OrcusRAT, Magecart payment skimming, SVG smuggling, and multi-vector DDoS botnets—making early detection andRUTSSTAGERRUTSSTAGER hides a DLL in the Windows registry (hex-encoded) to deploy OrcusRAT and a persistence/relaunch component, avoiding obvious on-disk artifacts.Vjw0rm[C2 Commands / Signals ] Vjw0rm / C2 detection commands (useful as hunting indicators) – Cl (execution termination), AW (active window data collection), Ex (PowerShell execution), and others: SF/RF, DL, DLF, Un
Vendors
Products
Claude Code2. macOS ClickFix Campaign Targets Claude Code Users with AMOS Stealer and Backdoor Access macOSMarch 2026 saw diverse, fast-moving campaigns that exploited trusted workflows—OAuth Device Code phishing, macOS ClickFix delivering AMOS Stealer and backdoors, registry-hidden DLL staging leading to OrcusRAT, MagecartMicrosoft 365 Apps for EnterpriseFrom Microsoft 365 token abuse and registry-hidden RAT delivery to card theft, macOS backdoor activity, and multi-vector DDoS operations, the threat landscape in March showed how much harder early detection has becomeMicrosoft WindowsRUTSSTAGER hides a DLL in the Windows registry (hex-encoded) to deploy OrcusRAT and a persistence/relaunch component, avoiding obvious on-disk artifacts.
Countries
ColombiaANY.RUN analysts observed a phishing campaign targeting organizations in Colombia, particularly in government, finance, oil and gas, and healthcare.IndiaRecent submissions show notable targeting across Technology, Education, Manufacturing, and Government & Administration, especially in the United States and India, while other regions are also affected.SpainANY.RUN analysts uncovered an active Magecart campaign targeting e-commerce websites, with a notable concentration in Spain.United StatesRecent submissions show notable targeting across Technology, Education, Manufacturing, and Government & Administration, especially in the United States and India, while other regions are also affected.
Industries
E-commerceANY.RUN analysts uncovered an active Magecart campaign targeting e-commerce websites, with a notable concentration in Spain.EducationAttacks observed in March affected industries including government, finance, healthcare, technology, education, manufacturing, and energy, with risks extending beyond initial access into token abuse, remote access, cardEnergyaffected industries including government, finance, healthcare, technology, education, manufacturing, and energy, with risks extending beyond initial access into token abuse, remote access, card theft, and broaderfinanceAttacks observed in March affected industries including government, finance, healthcare, technology, education, manufacturing, and energy, with risks extending beyond initial access into token abuse, remote access, cardGovernmentAttacks observed in March affected industries including government, finance, healthcare, technology, education, manufacturing, and energy, with risks extending beyond initial access into token abuse, remote access, cardHealthcareAttacks observed in March affected industries including government, finance, healthcare, technology, education, manufacturing, and energy, with risks extending beyond initial access into token abuse, remote access, cardManufacturingin March affected industries including government, finance, healthcare, technology, education, manufacturing, and energy, with risks extending beyond initial access into token abuse, remote access, card theft,Oil and gasANY.RUN analysts observed a phishing campaign targeting organizations in Colombia, particularly in government, finance, oil and gas, and healthcare.TechnologyAttacks observed in March affected industries including government, finance, healthcare, technology, education, manufacturing, and energy, with risks extending beyond initial access into token abuse, remote access, card