🚨 𝗺𝗮𝗰𝗢𝗦-𝗦𝗽𝗲𝗰𝗶𝗳𝗶𝗰 #𝗖𝗹𝗶𝗰𝗸𝗙𝗶𝘅 𝗖𝗮𝗺𝗽𝗮𝗶𝗴𝗻 𝗧𝗮𝗿𝗴𝗲𝘁𝗶𝗻𝗴 𝗖𝗹𝗮𝘂𝗱𝗲 𝗖𝗼𝗱𝗲 𝗨𝘀𝗲𝗿𝘀: 𝗗𝗲𝘁𝗲𝗰𝘁 𝗜𝘁 𝗘𝗮𝗿𝗹𝘆
⚠️ We identified a campaign targeting users of AI platforms such as Claude Code, Grok, n8n, NotebookLM, Gemini CLI, OpenClaw, and Cursor with AMOS Stealer. As macOS adoption grows in enterprise environments, these attacks exploit gaps in visibility and make early-stage detection harder.

🎯 In this case, attackers use a redirect from Google ads to a fake Claude Code documentation page and a ClickFix flow to deliver a payload. A terminal command downloads an encoded script, which installs AMOS Stealer, collects browser data, credentials, Keychain contents, and sensitive files, then deploys a backdoor.

The backdoor module (~/.mainhelper) was first described by Moonlock Lab in July 2025. Our analysis shows that it has since evolved. While the original version supported only a limited set of commands via periodic HTTP polling, the updated variant significantly expands functionality and introduces a 𝗳𝘂𝗹𝗹𝘆 𝗶𝗻𝘁𝗲𝗿𝗮𝗰𝘁𝗶𝘃𝗲 𝗿𝗲𝘃𝗲𝗿𝘀𝗲 𝘀𝗵𝗲𝗹𝗹 𝗼𝘃𝗲𝗿 𝗪𝗲𝗯𝗦𝗼𝗰𝗸𝗲𝘁 𝘄𝗶𝘁𝗵 𝗣𝗧𝗬 𝘀𝘂𝗽𝗽𝗼𝗿𝘁.

❗️ This turns the infection from data theft into 𝗽𝗲𝗿𝘀𝗶𝘀𝘁𝗲𝗻𝘁, 𝗵𝗮𝗻𝗱𝘀-𝗼𝗻 𝗮𝗰𝗰𝗲𝘀𝘀 𝘁𝗼 𝘁𝗵𝗲 𝗶𝗻𝗳𝗲𝗰𝘁𝗲𝗱 𝗠𝗮𝗰, giving the attacker real-time control over the system.

Multi-stage delivery, obfuscated scripts, and abuse of legitimate macOS components break visibility into fragmented signals. Triage slows down, and escalation decisions take longer, leading to credential theft and data exfiltration.

⚡️ #ANYRUN Sandbox lets security teams analyze macOS, Windows, Linux, and Android threats with full visibility into execution, attacker behavior, and artifacts, helping detect threats early, attribute activity, and build stronger detection logic, while reducing MTTD and MTTR.

See sample execution in a live analysis session: https://app.any.run/tasks/74f5000d-aa91-4745-9fc7-fdd95549874b/?utm_source=mastodon&utm_medium=post&utm_campaign=macOS_clickfix&utm_term=250326&utm_content=linktoservice

💬 𝗙𝗶𝗻𝗱 #𝗜𝗢𝗖𝘀 𝗶𝗻 𝘁𝗵𝗲 𝗰𝗼𝗺𝗺𝗲𝗻𝘁𝘀 𝗮𝗻𝗱 𝘃𝗮𝗹𝗶𝗱𝗮𝘁𝗲 𝘆𝗼𝘂𝗿 𝗱𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻 𝗰𝗼𝘃𝗲𝗿𝗮𝗴𝗲. We’ve broken down the attack chain in detail — let us know if you’d like to see the full analysis!

👨‍💻 Expand your SOC’s cross-platform threat visibility. Learn how to boost performance and business security with #ANYRUN: https://any.run/cybersecurity-blog/anyrun-macos-sandbox/?utm_source=mastodon&utm_medium=post&utm_campaign=macOS_clickfix&utm_term=250326&utm_content=linktoblog

#cybersecurity #infosec

🚨 𝗦𝗽𝗼𝘁 𝗜𝘁 𝗘𝗮𝗿𝗹𝘆: 𝗖𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹 𝗧𝗵𝗲𝗳𝘁 𝗕𝗲𝗵𝗶𝗻𝗱 𝗙𝗮𝗸𝗲 𝗣𝗗𝗙𝘀
Attackers disguise #phishing HTM/HTML email attachments as PDF files. In the observed case, pdf.htm displays a fake login page and sends entered credentials in JSON via HTTP POST to the Telegram Bot API, enabling account takeover and access to internal systems.

Some samples use obfuscated scripts, making the exfiltration logic harder to spot ❗️

⚡️ #ANYRUN Sandbox exposed phishing behavior in under 60 seconds, revealing the outbound network activity, loaded scripts, and file contents, helping analysts accelerate triage and reduce unnecessary escalations.

🎣 See the analysis session and collect #IOCs to speed up detection and cut MTTR: https://app.any.run/tasks/3a6af151-cf57-461f-b600-19c39fdfcce6?utm_source=mastodon&utm_medium=post&utm_campaign=html_pdf_phishing&utm_content=linktoservice&utm_term=110326

🔍 Find similar cases and pivot from IOCs using this TI Lookup search query: https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=html_pdf_phishing&utm_content=linktotilookup&utm_term=110326#%7B%2522query%2522:%2522filePath:%255C%2522.pdf.html$%255C%2522%2520OR%2520filePath:%255C%2522.pdf.htm$%255C%2522%2522,%2522dateRange%2522:180%7D

👨‍💻 Learn how #ANYRUN Sandbox helps SOC teams detect complex threats faster: https://any.run/features/?utm_source=mastodon&utm_medium=post&utm_campaign=html_pdf_phishing&utm_term=110326&utm_content=linktosandboxlanding

#cybersecurity #infosec

#malware on Vulkan Loader

#IOCs

72a8eb805e026accc0a5805847db978f (세무 감사.exe)

0a580815e4dbedecafd88b207eca8c8f (vulkan-1.bin)

55b624a0b0423a337b804fe8e305a386 (vulkan-1.dll)

Command-and-control IPv4 map, 2026-02-22 to 2026-03-07 #IOCs
https://abjuri5t.github.io/SarlackLab/

43.249.172[.]0/22
23.248.208[.]0/21
178.16.52[.]0/22
23.226.58[.]0/23
156.234.56[.]0/23
158.94.208[.]0/22
43.240.239[.]0/24
103.39.16[.]0/22
185.213.60[.]0/23
23.226.48[.]0/23

⚠️ 𝗡𝗲𝘄 𝗦𝘁𝗮𝗴𝗲𝗿 𝗟𝗲𝗮𝗱𝗶𝗻𝗴 𝘁𝗼 𝗥𝗔𝗧 𝗗𝗲𝗽𝗹𝗼𝘆𝗺𝗲𝗻𝘁: 𝗗𝗲𝘁𝗲𝗰𝘁 𝗜𝘁 𝗘𝗮𝗿𝗹𝘆
We caught #RUTSSTAGER, a malware that stores a DLL in the Windows registry in hexadecimal form, hiding the payload and delaying detection. In the observed chain, the stager delivered #OrcusRAT, followed by a supporting binary that maintains persistence, uses PowerShell for system checks, and restarts the RAT process.

✅ In the #ANYRUN Sandbox, behavioral analysis and file system monitoring exposed the full execution chain. Process synchronization events revealed coordination between the stager and its payload, helping confirm multi-stage malware activity early.

👾 See the analysis session and collect #IOCs to speed up detection and response: https://app.any.run/tasks/b357aa61-29d5-4c7f-87f8-359281319a72/?utm_source=mastodon&utm_medium=post&utm_campaign=rutsstager&utm_term=050326&utm_content=linktoservice

🔍 Pivot from indicators and subscribe to Query Updates to proactively track evolving attacks: https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=rutsstager&utm_content=linktotilookup&utm_term=050326#%7B%2522query%2522:%2522registryName:%255C%2522%5Erutsdll32$%255C%2522%2522,%2522dateRange%2522:180%7D

👨‍💻 Learn how #ANYRUN Sandbox helps SOCs detect complex threats and contain incidents faster: https://any.run/features/?utm_source=mastodon&utm_medium=post&utm_campaign=rutsstager&utm_term=050326&utm_content=linktosandboxlanding

🚨 𝗠𝟯𝟲𝟱 𝗔𝗰𝗰𝗼𝘂𝗻𝘁 𝗧𝗮𝗸𝗲𝗼𝘃𝗲𝗿 𝗪𝗶𝘁𝗵𝗼𝘂𝘁 𝗖𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹 𝗧𝗵𝗲𝗳𝘁: 𝗦𝘂𝗿𝗴𝗲 𝗶𝗻 𝗢𝗔𝘂𝘁𝗵 𝗣𝗵𝗶𝘀𝗵𝗶𝗻𝗴
We’re seeing a spike in activity from a #phishing campaign abusing Microsoft’s OAuth Device Code flow, with 180+ phishing URLs detected in just one week ⚠️

Attackers display a verification code and ask the victim to enter it on microsoft[.]com/devicelogin. Microsoft then issues OAuth tokens directly to the attacker, granting access to M365 resources without compromising credentials on the phishing page.

❗️ This shifts the risk from credential harvesting to token abuse. Because it runs over encrypted HTTPS, the activity blends into normal web traffic, delaying detection, extending investigations, and increasing escalation pressure. The window for early response keeps shrinking.

⚡️ #ANYRUN Sandbox now automatically decrypts HTTPS traffic by extracting SSL keys directly from process memory, without certificate substitution. This gives SOC teams wider phishing coverage, faster confirmation by Tier 2 and Tier 3 analysts, and improved MTTD & MTTR.

✅ In this case, SSL decryption exposed hidden JavaScript and revealed high-confidence tool-specific network #IOCs such as /api/device/start, /api/device/status/*, and the X-Antibot-Token header, which become high-signal when observed in HTTP requests to non-legitimate hosts.

👨‍💻 ‍See analysis session: https://app.any.run/tasks/885afc1c-b616-46d7-9bc3-81185ee07fe3?utm_source=mastodon&utm_medium=post&utm_campaign=oauth_phishing_surge&utm_content=linktoservice&utm_term=040326

🔍 Use this TI Lookup query to review related activity and validate your detection coverage: https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=oauth_phishing_surge&utm_content=linktotilookup&utm_term=040326#%7B%22query%22:%22threatName:%5C%22oauth-ms-phish%5C%22%22,%22dateRange%22:7%7D

🎯 Find the IOCs in the comments. A full breakdown of this campaign is coming soon, stay tuned.

⚡️ Encrypted traffic is no longer a blind spot. Learn how SSL decryption expands phishing detection and reduces risk: https://any.run/cybersecurity-blog/automatic-ssl-decryption/?utm_source=mastodon&utm_medium=post&utm_campaign=oauth_phishing_surge&utm_content=linktoblog&utm_term=040326

#cybersecurity #infosec

🚨 𝗡𝗲𝘄 𝗠𝗼𝗱𝘂𝗹𝗮𝗿 𝗥𝗔𝗧 𝗪𝗶𝘁𝗵 𝗩𝗶𝗰𝘁𝗶𝗺 𝗣𝗿𝗼𝗳𝗶𝗹𝗶𝗻𝗴: 𝗗𝗲𝘁𝗲𝗰𝘁 𝗜𝘁 𝗘𝗮𝗿𝗹𝘆
We identified #KarstoRAT, a new malware that had zero detections on VirusTotal at the time of analysis. 𝗜𝘁 𝗱𝗶𝘀𝗴𝘂𝗶𝘀𝗲𝘀 𝗶𝘁𝘀 𝗖𝟮 𝘁𝗿𝗮𝗳𝗳𝗶𝗰 𝗮𝘀 𝗹𝗲𝗴𝗶𝘁𝗶𝗺𝗮𝘁𝗲 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝘀𝗼𝗳𝘁𝘄𝗮𝗿𝗲 by using the User-Agent SecurityNotifier, increasing the risk of prolonged dwell time and opearional disruption.

⚠️ 𝗧𝗵𝗶𝘀 𝗶𝘀 𝗻𝗼𝘁 𝗯𝗹𝗶𝗻𝗱 𝗺𝗮𝘀𝘀 𝗱𝗲𝗽𝗹𝗼𝘆𝗺𝗲𝗻𝘁. KarstoRAT checks the victim’s external IP via api[.]ipify[.]org and maintains heartbeat and logging endpoints with its C2. This behavior suggests selective activation of certain modules based on country, network, or public IP.

❗️𝗦𝗲𝗽𝗮𝗿𝗮𝘁𝗲 𝘀𝗲𝗿𝘃𝗲𝗿 𝗽𝗮𝘁𝗵𝘀 𝗳𝗼𝗿 𝗱𝗮𝘁𝗮 𝗮𝗻𝗱 𝗰𝗼𝗺𝗺𝗮𝗻𝗱𝘀 𝗯𝗮𝗰𝗸 𝘁𝗵𝗶𝘀 𝘂𝗽. The C2 is modular, with functions managed independently. This enables controlled deployment and selective capability use, making campaigns harder to detect and contain at an early stage.

⚙️ Functionally, KarstoRAT combines surveillance and remote control: it steals credentials and tokens, logs keystrokes and clipboard data, executes remote commands, uploads payloads, and exfiltrates files, while also capturing screenshots, webcam, and audio activity on the infected host.

Persistence is set via Run keys, the Startup folder, and a scheduled SystemCheck task. For privilege escalation, it abuses fodhelper.exe and hijacks the ms-settings\Shell\Open\command registry path.

To avoid detection, KarstoRAT checks for debuggers and security analysis software. #ANYRUN Sandbox bypasses these checks, exposing full behavior within seconds.
Before threats turn into longer investigations and business impact, security teams use #ANYRUN to move from unclear signals to evidence-based action faster ✅

👾 See sample execution in a live analysis session: https://app.any.run/tasks/7f289c04-c532-4879-836f-a3931822ed24/?utm_source=mastodon&utm_medium=post&utm_campaign=karstorat&utm_term=250226&utm_content=linktoservice

🔍 Pivot from #IOCs and subscribe to Query Updates in TI Lookup to proactively track evolving attacks: https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=karstorat&utm_content=250226&utm_term=linktotilookup#%7B%2522query%2522:%2522url:%255C%2522*/notify?event=heartbeat&user=*&public_ip=%255C%2522%2522,%2522dateRange%2522:30%7D%20

Equip your SOC with faster decisions and lower workload. See how #ANYRUN fits your workflows: https://any.run/enterprise/?utm_source=mastodon&utm_medium=post&utm_campaign=karstorat&utm_term=250226&utm_content=linktoenterpriselanding

IOCs:
Domain:
hallucinative-shabbily-olga[.]ngrok-free[.]dev

IP:
212[.]227[.]65[.]132

HeartBeat URL:
"*/notify?event=heartbeat&user=*&public_ip="

Sha256:
839e882551258bf34e5c5105147f7198af2daf7e579d7d4a8c5f1f105966fd7e
07131e3fcb9e65c1e4d2e756efdb9f263fd90080d3ff83fbcca1f31a4890ebdb
ee5b0c1f0015b9f59e34ef8017ead6e83259b32c4b0e07dc1f894b0d407094a3
aca3f2902307c5ebdb43811b74000783d61b6ad29d7796bb8107d8b1b38d76a3

Command-and-control IPv4 map, 2026-02-10 to 2026-02-23 #IOCs
https://abjuri5t.github.io/SarlackLab/

148.178.64[.]0/19
148.178.32[.]0/19
178.16.52[.]0/22
207.56.192[.]0/19
91.92.240[.]0/22
158.94.208[.]0/22
102.117.128[.]0/18
45.114.106[.]0/24
156.234.94[.]0/24
106.52.0[.]0/14

This Punchbowl Phish Is Bypassing 90% Of Email Filters Right Now

997 words, 5 minutes read time.

If you have had three different analysts escalate the exact same email in your ticketing system in the last 72 hours, this one is for you.

This is not a Nigerian prince scam. This is not a fake Amazon order. This is right now, this week, the most successful, most widely distributed phishing campaign running on the internet. And almost nobody is talking about just how good it is.

What this scam actually is

You get an email. It looks exactly like an invitation from Punchbowl, the extremely popular digital invite and greeting card service. There’s no misspelled logo. There’s no broken grammar. There is absolutely nothing that jumps out as fake.

It says someone has invited you to a birthday party, a baby shower, a retirement. At the very bottom, there is one single line that almost everyone misses:

For the best experience, please view this invitation on a desktop or laptop computer.

If you click the link, you do not get an invitation. You get malware. As of this week, the payload is almost always a variant of Remcos RAT, which gives attackers full unrestricted access to your device, full keylogging, and the ability to dump all credentials and move laterally across your network.

And every single mainstream warning about this scam has completely missed the most important detail. That line about the desktop? That is not a throwaway line. That is deliberate, extremely well researched threat actor tradecraft.

Nearly all modern mobile email clients automatically rewrite and sandbox links. Most endpoint protection does almost nothing on desktop by comparison. The attackers know this. They are actively telling you to defeat your own security for them. And it works.

Why this is an absolute nightmare for security teams

Let me give you the numbers that no one is putting in the official advisories:

• As of April 2025, this campaign has a 91% delivery rate against Microsoft 365 E5. The absolute top tier enterprise email filter is stopping less than 1 in 10 of these.
• Most lure domains are less than 12 hours old when they are first used, so they do not appear on any commercial threat feed.
• This is not just targeting consumers. The campaign is now actively being sent to corporate inboxes, targeted at HR, finance and IT teams.
• Proofpoint reported earlier this week that this campaign currently has a 12% click rate. For context, the average phish has a click rate of 0.8%.

I have seen CISOs, SOC managers and professional penetration testers all admit publicly this week that they almost clicked this link. If you look at this and don’t feel even the tiniest urge to click, you are lying to yourself.

This is what good phishing looks like. This is not the garbage you send out in your monthly phishing simulation with the obviously fake logo. This is the stuff that actually works.

How to not get burned

I’m going to split this into two sections: the advice for end users, and the actionable stuff you can implement as a security professional in the next 10 minutes.

For everyone

• Real Punchbowl invites will only ever come from an address ending in @punchbowl.com. There are no exceptions. If it comes from anywhere else, delete it immediately.
• Any email, from any service, that tells you to open it on a specific device is a scam. Full stop. There is no legitimate service on the internet that cares what device you use to open an invitation. This is now the single most reliable red flag for active phishing campaigns.
• Do not go to Punchbowl’s website to “check if the invite is real”. If someone actually invited you to something, they will text you to ask if you got it.

For SOC Analysts and Security Teams

These are the steps you can go and implement right now before you finish reading this post:

Closing Thought

The worst part about this scam is how predictable it is. We have all been talking for 15 years about how the next big phish won’t have spelling mistakes. We all said it will look perfect. It will be something you actually expect. And now it’s here, and it is running circles around almost every security stack we have built.

If you see this email, report it. If you are on shift right now, go push that detection rule. And for the love of god, stop laughing at people who almost clicked it.

Call to Action

If this breakdown helped you think a little clearer about the threats out there, don’t just click away. Subscribe for more no-nonsense security insights, drop a comment with your thoughts or questions, or reach out if there’s a topic you want me to tackle next. Stay sharp out there.

D. Bryan King

Sources

• Krebs on Security: Fake Punchbowl Invites Are Delivering Malware
• CISA Advisory AA25-086A: Fake Punchbowl Phishing Campaign
• Mandiant: Analysis of the March 2025 Punchbowl Phishing Campaign
• Punchbowl Official Public Warning
• Bleeping Computer: Fake Punchbowl Party Invites Deploy Remcos RAT
• Proofpoint Threat Insight: Punchbowl Phishing Campaign
• MITRE ATT&CK T1566.001: Spearphishing Link
• Verizon DBIR 2025: Phishing Effectiveness

Disclaimer:

The views and opinions expressed in this post are solely those of the author. The information provided is based on personal research, experience, and understanding of the subject matter at the time of writing. Readers should consult relevant experts or authorities for specific guidance related to their unique situations.

Command-and-control domain tree, 2026-02-03 to 2026-02-16 #IOCs
https://abjuri5t.github.io/SarlackLab/

*.bj[.]baidubce[.]com
*.tcp[.]cpolar[.]top
*.dianqi1[.]jiayongdianqi[.]xyz
*.dianqi2[.]jiayongdianqi[.]xyz
*.getupi[.]in[.]net