Learn how Kali365 has been abusing Microsoft device login to gain OAuth tokens, targeting US firms, and how SOC teams can detect, hunt, and stop these phishing attacks.

PhantomEnigma abuses Brazilian government websites and trusted email channels to spread malware, target banks, evade security checks, and maintain access.

EvilTokens phishing hides takeover clues until browser execution leaving SOC teams needing deeper visibility to validate threats faster and reduce account risk.

Disclosure: This article was provided by ANY.RUN. The information and analysis presented are based on their research and findings.

Disclosure: This article was provided by ANY.RUN. The information and analysis presented are based on their research and findings.

Disclosure: This article was provided by ANY.RUN. The information and analysis presented are based on their research and findings.

Active HanGhost Loader campaign targets enterprise payment and logistics workflows with fileless attacks, multi-stage execution, and stealthy malware delivery.