ANY.RUN describes five September campaigns targeting US and EU users and organizations, involving Microsoft 365 session and token theft, remote-access tools, payment-card and OTP theft, evasive phishing, and multi-stage payload delivery.
ANY.RUN researchers detail CSuite, a campaign combining business-themed phishing, Microsoft 365 credential and session theft, device-code attacks, and legitimate remote-management tools to gain access to accounts and endpoints.
Researchers detail a phishing campaign targeting Latin American financial organizations with fake DocuSign and tax-document lures that install a custom HVNC backdoor for hidden remote access, data theft, and persistence.