14 minhigh
US Threat Landscape Alert: 30 Active Malware Families Ranked by Real Sandbox Data
ANY.RUN's Malware Trends Tracker data shows that phishing-as-a-service kits now dominate the US threat landscape, with five of the top ten threats being AiTM or device-code phishing platforms that defeat MFA by stealing session cookies or OAuth tokens. Commodity RATs and info stealers remain in constant high-volume circulation, while legacy threats like Emotet and WannaCry persist on unpatched systems. Several top-ranked threats (Cobalt Strike, Qbot, Emotet, DonutLoader, Smoke Loader) function as ransomware precursors, meaning their detection should trigger urgent escalation rather than routine handling.
Sens:▲ 24h
Detection / Hunteropenrouter
What Happened
A security company called ANY.RUN analyzed real malware data from their sandbox platform and ranked the 30 most active threats targeting US organizations. The biggest finding is that attackers have shifted from stealing passwords to stealing login sessions — they use phishing kits that can bypass multi-factor authentication (MFA) by intercepting the session cookie or authorization token that gets created after a user successfully logs in. This means that even having MFA enabled no longer guarantees protection. US organizations across all industries are affected, especially those using Microsoft 365. The report also shows that old malware like Emotet and WannaCry is still actively infecting systems that haven't been updated, and that cheap, widely available remote access tools and password stealers remain a constant threat. Organizations should consider upgrading to phishing-resistant MFA (like hardware security keys), ensuring all systems are patched, and treating detections of certain malware like Cobalt Strike or Qbot as early warning signs of a potential ransomware attack rather than isolated incidents.
Key Takeaways
- Five of the top ten US threats are phishing-as-a-service kits (Sneaky 2FA, EvilTokens, EvilProxy, Kali365, FlowerStorm) that defeat MFA via adversary-in-the-middle reverse proxies or device-code flow abuse, shifting the attack surface from password theft to session/token theft.
- Kali365 and EvilTokens abuse Microsoft's legitimate device-code authorization flow, meaning victims complete a real MFA challenge on Microsoft's real infrastructure while attackers capture a valid OAuth token — no fake login page required.
- Legacy malware Emotet and WannaCry still show active monthly volume, indicating that unpatched and legacy-exposed systems remain a live attack surface years after their headline incidents.
- Commodity stealers and RATs (AsyncRAT, Vidar, XWorm, Stealc, RedLine, Lumma) account for high monthly volume due to low cost and constant rebranding; Remus Stealer emerged as a direct successor to Lumma using EtherHiding for C2 resilience.
- Cobalt Strike beacons, Qbot infections, and DonutLoader activity are early ransomware indicators — treating these as urgent rather than routine is a high-leverage SOC decision.
Affected Systems
- Microsoft 365 environments
- Google Workspace environments
- Windows endpoints (legacy and unpatched systems especially vulnerable to WannaCry/EternalBlue)
- macOS endpoints (targeted by NetWire and XLoader/Formbook variants)
- IoT devices including routers and cameras (Mirai)
- Organizations across finance, healthcare, manufacturing, government, technology, logistics, professional services, and education sectors
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: PhaaS kits (Sneaky 2FA, EvilProxy, Tycoon 2FA, FlowerStorm) use AiTM reverse proxies to capture session cookies after MFA, or device-code phishing kits (Kali365, EvilTokens) abuse Microsoft's OAuth device-authorization flow to steal valid tokens
- Execution: Commodity RATs and stealers (AsyncRAT, Vidar, XWorm, Stealc, RedLine) delivered via phishing attachments, malvertising, or cracked-software downloads execute on victim endpoints
- Persistence: Kali365 creates malicious inbox rules to suppress security warnings; Remus Stealer uses Ethereum smart contracts (EtherHiding) for resilient C2 infrastructure
- Defense Evasion: DonutLoader converts payloads to position-independent shellcode for fileless execution inside trusted processes; EvilTokens uses AES-GCM-encrypted browser-side content to defeat static analysis; Tycoon 2FA uses Cloudflare Turnstile to block security scanners
- Lateral Movement: Cobalt Strike beacons enable stealthy lateral movement and privilege escalation across compromised networks; Qbot and Emotet serve as initial-access brokers for ransomware affiliates
- Impact: Ransomware deployment (WannaCry, XWorm ransomware module, DCRat ransomware plugin) or data exfiltration via alternative channels (SMTP, FTP, Telegram bots for Agent Tesla; Ethereum smart contracts for Remus Stealer)
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide any detection rules or queries. It references ANY.RUN's Threat Intelligence Lookup as a platform that can pivot from YARA/Sigma rules to related sessions, and mentions TI Feeds delivering IOCs in STIX/TAXII, CSV, or JSON formats, but no actual rule content or queries are included in the article.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR tools can detect many of the commodity RATs and stealers listed, but fileless loaders like DonutLoader that execute payloads in-memory without writing to disk can evade signature-based EDR detection. Session cookie theft and OAuth token abuse via device-code phishing occur at the authentication layer, which is typically outside EDR visibility. |
| Network Visibility | Medium | AiTM reverse proxy traffic and device-code OAuth flow abuse may blend with legitimate Microsoft 365 authentication traffic. Info stealers like Vidar use legitimate platforms (Telegram, Steam) as dead-drop resolvers, making C2 traffic appear benign. Agent Tesla exfiltrates via SMTP, FTP, and Telegram bots, which may not be flagged by standard network monitoring. |
| Detection Difficulty | Hard | The top threats abuse legitimate authentication flows and legitimate platforms for C2, making network-based detection difficult. Fileless execution via DonutLoader evades disk-based signatures. PhaaS kits employ anti-bot checks, Cloudflare Turnstile, and AES-GCM-encrypted browser-side content to block analysis. Session cookie and OAuth token theft occur at the identity layer, requiring specialized conditional access and session monitoring rather than traditional endpoint or network detection. |
Required Log Sources
- Microsoft 365 sign-in logs and conditional access logs
- Azure AD audit logs for device-code authentication events
- Exchange Online mailbox audit logs for suspicious inbox rule creation
- EDR process creation and command-line telemetry
- DNS query logs for C2 resolution and dead-drop resolver lookups
- Web proxy logs for AiTM reverse proxy traffic
- Network flow logs for outbound SMTP/FTP/Telegram bot exfiltration
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for device-code authentication flow completions where the initiating device or IP does not match the user's typical sign-in pattern, as this may indicate device-code phishing via Kali365 or EvilTokens. | Azure AD sign-in logs, conditional access logs, device-code authentication event logs | Initial Access | Medium — legitimate device-code flows from managed devices, BYOD scenarios, or smart TV/IoT device logins may generate similar patterns. |
| Consider hunting for newly created inbox rules that forward, delete, or move emails from security alert senders, as Kali365 creates malicious inbox rules to suppress security warnings post-compromise. | Exchange Online mailbox audit logs, Microsoft 365 audit logs for inbox rule creation events | Persistence | Low to Medium — legitimate users rarely create rules that specifically target security notification emails. |
| Consider hunting for processes executing in-memory without corresponding file writes to disk, particularly involving .NET assembly loading via techniques associated with DonutLoader, as this may indicate fileless payload delivery. | EDR process telemetry, memory scanning events, .NET assembly load events | Defense Evasion | Medium — legitimate administrative tools and some software installers use in-memory execution patterns. |
| Consider hunting for outbound network connections to Telegram API endpoints, Steam profile pages, or Ethereum blockchain APIs from non-browser processes, as these may indicate dead-drop C2 resolution by info stealers like Vidar or Remus Stealer. | Network flow logs, DNS query logs, EDR network connection events | Command and Control | Medium — legitimate use of Telegram, Steam, or Ethereum applications on corporate endpoints could generate similar traffic. |
| Consider hunting for Cobalt Strike beacon network patterns and lateral movement activity, as Cobalt Strike detections frequently signal that attackers already have a foothold and are preparing for ransomware deployment. | EDR network connection events, network flow logs, Windows event logs for lateral movement indicators, SMB session logs | Lateral Movement | Low — Cobalt Strike beacons in corporate environments are almost always unauthorized unless authorized red team activity is underway. |
Control Gaps
- Standard MFA (push notifications, one-time codes) does not prevent session cookie theft via AiTM reverse proxies or OAuth token theft via device-code phishing — only phishing-resistant MFA (hardware security keys) addresses this gap.
- Signature-based EDR and AV tools may miss fileless execution via DonutLoader and constantly repackaged commodity RAT variants with minor code changes.
- Static analysis of phishing pages is defeated by AES-GCM-encrypted browser-side content (EvilTokens) and anti-bot/Cloudflare Turnstile checks (Tycoon 2FA, Sneaky 2FA).
- Network-based detection may miss C2 traffic that abuses legitimate platforms (Telegram, Steam, Ethereum smart contracts) as dead-drop resolvers.
- Conditional access policies may not restrict or monitor device-code authentication flows, leaving a gap exploited by Kali365 and EvilTokens.
Key Behavioral Indicators
- Unexpected device-code authentication flow completions from atypical locations or devices
- Newly created inbox rules that suppress, forward, or delete security notification emails
- In-memory .NET assembly loading without corresponding file on disk, consistent with DonutLoader behavior
- Non-browser processes making outbound connections to Telegram API, Steam profile pages, or Ethereum blockchain RPC endpoints
- Cobalt Strike beacon network patterns including periodic HTTPS beacons to unknown infrastructure
- Unusual outbound SMTP, FTP, or Telegram bot API traffic from user workstations, consistent with Agent Tesla exfiltration
- Suspicious reverse proxy TLS interception patterns where Microsoft 365 login traffic transits non-Microsoft IP ranges
- Rapid creation of new OAuth application sessions or refresh token usage from unexpected endpoints
False Positive Assessment
Medium — Several of the described threats abuse legitimate platforms and authentication flows, making behavioral detection prone to false positives. Device-code authentication flows, Telegram API connections, Steam profile access, and inbox rule creation all have legitimate use cases. Effective detection requires correlating multiple signals rather than relying on single indicators.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider reviewing recent Microsoft 365 sign-in logs for device-code authentication flow completions from atypical locations or devices, as this may indicate active Kali365 or EvilTokens phishing.
- Consider auditing Exchange Online mailbox rules across all user accounts for suspicious forwarding, deletion, or movement rules targeting security notification emails, which may indicate Kali365 post-compromise persistence.
- If your EDR supports it, consider hunting for in-memory .NET assembly loading events consistent with DonutLoader fileless execution, and escalate any Cobalt Strike beacon detections as potential ransomware precursors rather than routine malware.
- Consider reviewing conditional access policies to restrict or monitor device-code authentication flows for Microsoft 365, and evaluate whether blocking or requiring additional verification for device-code flow logins from unmanaged devices is feasible.
Infrastructure Hardening
- Consider deploying phishing-resistant MFA (FIDO2 hardware security keys) for all privileged accounts and high-value targets, as push-notification and one-time-code MFA are defeated by AiTM and device-code phishing kits.
- Evaluate whether your conditional access policies can enforce device compliance or trusted-location requirements for Microsoft 365 authentication, particularly for device-code flow logins.
- Consider implementing session token revocation and continuous session evaluation policies to limit the window of opportunity for stolen session cookies.
- If supported by your email security platform, consider enabling enhanced detection for AiTM reverse proxy patterns and device-code phishing lures.
- Consider ensuring all Windows systems are patched against EternalBlue (MS17-010) and other legacy SMB vulnerabilities, as WannaCry activity indicates unpatched systems remain exposed.
User Protection
- Consider deploying endpoint protection that includes behavioral and memory-based detection capabilities, not just signature-based scanning, to address fileless loaders like DonutLoader and constantly repackaged commodity RATs.
- If applicable, consider restricting or monitoring access to cracked software download sites and malvertising-heavy web destinations, as these are primary delivery vectors for Vidar, Stealc, RedLine, and Lumma/Remus Stealer.
- Consider evaluating whether your web filtering can block known AiTM phishing infrastructure and reverse proxy endpoints used by Sneaky 2FA, EvilProxy, Tycoon 2FA, and FlowerStorm.
- If your organization supports IoT devices, consider segmenting them from critical network segments and enforcing strong, unique credentials to reduce Mirai exposure.
Security Awareness
- Consider updating phishing awareness training to emphasize that MFA prompts and real Microsoft login pages no longer guarantee safety — device-code phishing attacks use legitimate Microsoft infrastructure.
- Consider training users to report any unexpected device-code login prompts or QR code authentication requests, as these are the primary delivery mechanism for Kali365 and EvilTokens.
- Consider educating finance and executive staff specifically on the risk of session cookie theft enabling business email compromise, as EvilTokens includes AI-assisted BEC tooling.
- Consider reinforcing the importance of not downloading cracked software, as it is a primary delivery vector for multiple top-ranked info stealers including Vidar, Stealc, RedLine, and Lumma/Remus.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping14 techniques
Tactic
Initial Access
Tactic
Persistence
Tactic
Stealth
Tactic
Credential Access
Tactic
Lateral Movement
Tactic
Collection
Tactic
Command and Control
Tactic
Exfiltration
Tactic
