{"id":19659,"date":"2026-03-31T10:24:19","date_gmt":"2026-03-31T10:24:19","guid":{"rendered":"\/cybersecurity-blog\/?p=19659"},"modified":"2026-10-14T12:18:50","modified_gmt":"2026-10-14T12:18:50","slug":"release-notes-march-2026","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/release-notes-march-2026\/","title":{"rendered":"Release Notes: Cross-Platform Threat Analysis with macOS, SSL Decryption, and 1,300+ New Detections"},"content":{"rendered":"\n

March was a packed month for ANY.RUN<\/a>. We rolled out major product improvements that help security teams investigate phishing inside encrypted traffic, expand cross-platform analysis with macOS, and bring Windows Server into the sandbox workflow. <\/p>\n\n\n\n

At the same time, our detection team continued to strengthen threat coverage with new behavior signatures, Suricata rules, and fresh threat intelligence reports focused on active malware and attack techniques. <\/p>\n\n\n\n

Here\u2019s a closer look at what\u2019s new. <\/p>\n\n\n\n

Product Updates <\/h2>\n\n\n\n

This month\u2019s updates are all about helping security teams see more and investigate with less friction. We improved phishing detection inside encrypted traffic, expanded sandbox coverage<\/a> to macOS, and added Windows Server analysis so teams can work across more of the environments they protect every day.<\/p>\n\n\n\n

Automatic SSL Decryption for Stronger Phishing Detection <\/h3>\n\n\n\n

Encrypted HTTPS traffic remains one of the main reasons phishing is harder to confirm quickly. It hides credential theft, redirect chains, and token-based attacks inside traffic that often appears legitimate, forcing teams to spend more time on validation and increasing the chance of missed compromise.<\/p>\n\n\n\n

In March, ANY.RUN introduced automatic SSL decryption<\/strong><\/a> in the Interactive Sandbox<\/a> across all subscription tiers. By extracting encryption keys directly from process memory, the sandbox can now inspect decrypted traffic during analysis and apply Suricata rules, detection signatures, and IOC extraction immediately.<\/p>\n\n\n\n

Check real-world example: Detecting Salty2FA phishing campaign with SSL decryption<\/a><\/p>\n\n\n

\n
\"\"
Automatic SSL decryption provides a major phishing detection boost in the sandbox<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n

This significantly expands phishing visibility across every sandbox session. After implementing the technology, ANY.RUN saw a 5x increase in SSL-decrypted phishing detection and added 60,000 more confirmed malicious URLs to TI Lookup<\/a> each month. <\/p>\n\n\n\n

For your SOC, this means: <\/p>\n\n\n\n