{"id":10604,"date":"2024-12-23T11:55:48","date_gmt":"2024-12-23T11:55:48","guid":{"rendered":"\/cybersecurity-blog\/?p=10604"},"modified":"2024-12-23T11:55:49","modified_gmt":"2024-12-23T11:55:49","slug":"cyber-attacks-december-2024","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/cyber-attacks-december-2024\/","title":{"rendered":"5 Major Cyber Attacks in December 2024"},"content":{"rendered":"\n

The cybersecurity research team of ANY.RUN<\/a> found and analyzed a bunch of emerging threats with the help of our mighty Interactive Sandbox<\/a> and Threat Intelligence Lookup<\/a>.<\/p>\n\n\n\n

We\u2019ve been sharing their findings via X<\/a> and in our blog<\/a>. Here is a summary on the most interesting insights from December 2024.<\/p>\n\n\n\n

Phishing Campaigns targeting Microsoft\u2019s Azure Blob Storage<\/h2>\n\n\n\n

Original post on X<\/em><\/a><\/p>\n\n\n

\n
\"\"
Phishing page: HTML document with a characteristic attribute<\/em><\/figcaption><\/figure><\/div>\n\n\n

Cyber criminals are abusing Microsoft’s cloud-based file storage solution by hosting phishing pages on the service, employing techniques like HTML smuggling.<\/p>\n\n\n\n

The phishing pages are HTML documents that contain a block input element with the ID attribute “doom”. The pages include information about users\u2019 software obtained via JScript (OS and browser), to make them more convincing.

Phishing pages on Azure Blob Storage typically have a short lifespan. Attackers may host pages with redirects to phishing sites. With minimal suspicious content, these pages can evade detection slightly longer.<\/p>\n\n\n\n

See the analysis session<\/a> in the ANY.RUN sandbox.<\/p>\n\n\n

\n
\"\"
User’s credentials get stolen from fake sign-in form<\/em><\/figcaption><\/figure><\/div>\n\n\n