6 minhigh
Phishing Risk Across 5 Key US Industries: ANY.RUN Data & Mitigation Strategies
Phishing exposure exceeds 70% across US finance, banking, manufacturing, government, and tech sectors, with attackers shifting to AiTM, session theft, and user-driven execution. Attackers are shifting from malware delivery to identity-focused attacks using AiTM, session theft, and token abuse. ClickFix campaigns manipulate users into executing commands via fake CAPTCHAs. Defense requires visibility into post-click behavior including redirects, scripts, and network activity.
Sens:7dConf:medium
IOCs7
3domain2ip2url
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Block chiocciola40.it, checkingweb.net, and norhen.store at web proxy and DNS
- Hunt for headless Edge processes spawning cmd.exe or mshta.exe
- Review authentication logs for sessions initiated to newly registered domains
- If EDR supports process blocking, block msedge.exe --headless spawning shells
Key Takeaways
- Finance has 73.4% phishing exposure; manufacturing 72.2%.
- Emails are 54.4% of submissions; archives 19.7%; PDFs 9%.
- Top threats: Tycoon (15%), Sneaky2FA (13.4%), ClickFix (10.4%), EvilProxy (9.8%), EvilTokens (6.5%).
- ClickFix uses fake CAPTCHAs to trick users into running malicious commands via clipboard paste.
- Average MTTD with ANY.RUN sandbox is 14 seconds; 16.3 sec for banking, 17 sec for technology.
Attack Chain
- Initial Access: Phishing email delivers archive, PDF, or link to victim across finance, banking, manufacturing, government, or tech sectors
- Execution: ClickFix lures trick users into pasting malicious commands via Run dialog (T1059.003); headless Edge spawns mshta
- Credential Access: AiTM phishing kits (Tycoon, Sneaky2FA, EvilProxy) intercept credentials and authentication sessions
- Defense Evasion: Phishing pages use JavaScript blacklist and bot-trap systems to block security analysis tools
- Persistence/Access: EvilTokens targets access tokens and authenticated sessions for ongoing access
Affected Systems
- Windows endpoints (ClickFix targets Run dialog)
- Web browsers (AiTM phishing, fake CAPTCHAs)
- Email gateways (initial delivery vector)
- PDF viewers (JavaScript execution in lures)
- Archive extraction tools (encrypted archive payloads)
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can detect process spawning (msedge.exe spawning cmd.exe/mshta) but may miss in-browser JavaScript activity. |
| Network Visibility | Medium | Network logs show connections to phishing domains and IPs but encrypted traffic limits payload visibility. |
| Detection Difficulty | Moderate | Behavioral indicators like headless browser spawning shells are detectable but user-driven execution and AiTM proxying complicate detection. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Headless browser processes spawning command shells or script interpreters indicate ClickFix-style user-driven execution (T1059.003). | EDR process creation and command line logs | Execution | Low — headless browsers rarely spawn shells in normal use |
| Web sessions to newly registered domains followed by credential submission indicate AiTM phishing (T1566.002, T1556.001). | Web proxy, DNS, and authentication logs | Credential Access | Medium — legitimate new domains may trigger alerts |
| JavaScript blacklist and bot-trap systems on web pages indicate phishing infrastructure evading analysis tools (T1027). | Web proxy and sandbox analysis logs | Defense Evasion | Medium — some legitimate sites use bot detection |
Required Log Sources
- Web proxy logs
- DNS resolution logs
- EDR process telemetry
- Email gateway logs
- Browser security events
Key Behavioral Indicators
- msedge.exe running with --headless flag spawning child processes
- Browser processes spawning cmd.exe or mshta.exe
- Web requests to domains with blacklist evasion JavaScript
- Credential submission to newly registered or low-reputation domains
- Headless browser execution with --disable-gpu-sandbox flag
- Clipboard paste followed by Run dialog execution on Windows
Control Gaps
- Email filtering alone cannot detect post-click phishing behavior
- MFA does not prevent AiTM session token theft
- Static URL reputation may miss newly registered phishing domains
- Traditional AV does not detect user-driven execution via clipboard paste
False Positive Assessment
Medium — Headless browser spawning shells is unusual but may occur in legitimate automation; newly registered domains may include legitimate business sites.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Enable TLS inspection for outbound traffic to detect AiTM phishing proxies
- Deploy web proxy categories to block newly registered domains by default
- Configure email gateway to quarantine encrypted archive attachments for analysis
- Implement conditional access policies validating device trust and session origin
User Protection
- Deploy endpoint protection capable of detecting clipboard-to-Run-dialog execution chains
- Enable browser security extensions that flag fake CAPTCHA and verification prompts
- Restrict mshta.exe execution via application control policies
Security Awareness
- Train users to recognize ClickFix fake CAPTCHA prompts requesting Run dialog use
- Instruct users never to paste clipboard content into the Run dialog
- Advise users to verify Adobe license updates through official channels, not in-browser prompts
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping14 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Credential Access
Tactic
Command and Control
Plain-Language Summary
Cybercriminals are using advanced phishing techniques to target major US industries, especially finance, manufacturing, and government. Instead of just stealing passwords, attackers now intercept login sessions and trick users into running malicious commands. Organizations should use behavioral analysis tools to monitor what happens after a user clicks a link or opens a file.
Additional IOCs
- Command Lines:
- Purpose: Execute malicious payload via headless Edge browser spawning mshta | Tools:
msedge.exe,cmd.exe,mshta| Stage: Execution
- Purpose: Execute malicious payload via headless Edge browser spawning mshta | Tools:
- Other:
norhen.store/tpl/hebe/hebe.css?v=20230922222243pm- Suspicious CSS resource path on norhen.store phishing site
Showing defanged values
- domaincheckingweb[.]netFake Adobe document viewer phishing lure domain
- domainchiocciola40[.]itClickFix fake CAPTCHA domain serving malicious commands
- domainnorhen[.]storeMalicious domain observed in US manufacturing phishing submissions
- ip188[.]114[.]96[.]3IP associated with norhen.store phishing infrastructure
- ip188[.]114[.]97[.]3IP associated with norhen.store phishing infrastructure
- urlhxxps://checkingweb[.]net/Adobe/Fake Adobe license update phishing page
- urlhxxps://norhen[.]store/Malicious URL from manufacturing sector phishing analysis
