{"id":22886,"date":"2026-08-26T09:17:40","date_gmt":"2026-08-26T09:17:40","guid":{"rendered":"https:\/\/any.run\/cybersecurity-blog\/?p=22886"},"modified":"2026-08-26T09:21:13","modified_gmt":"2026-08-26T09:21:13","slug":"phishing-us-finance","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/phishing-us-finance\/","title":{"rendered":"US Finance Under Phishing Pressure: What the SOC Data Reveals?"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">With modern campaigns such as <a href=\"https:\/\/any.run\/cybersecurity-blog\/us-campaign-malware-analysis\/\" target=\"_blank\" rel=\"noreferrer noopener\">Vercel-hosted RMM attacks<\/a>, the scale and security impact of <a href=\"https:\/\/any.run\/use-case\/phishing\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=phishing-us-finance&amp;utm_term=260826&amp;utm_content=linktophishing\" target=\"_blank\" rel=\"noreferrer noopener\">phishing<\/a> in US finance should not be understated. As threats get increasingly harder to detect, the phishing challenge raises the stakes in the industry. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Legitimate services and tools used in daily workflows across corporate America are increasingly <a href=\"https:\/\/any.run\/cybersecurity-blog\/kali365-phishing-targeting-us\/\" target=\"_blank\" rel=\"noreferrer noopener\">abused<\/a> to deliver phishing attacks or disguise malicious activity. <a href=\"https:\/\/any.run\/cybersecurity-blog\/mirage2fa-phishing-targets-us-companies\/\" target=\"_blank\" rel=\"noreferrer noopener\">Identity-based attacks<\/a> let threat actors spread across an organization from a single, barely detectable entry point. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">At the same time, malware itself is only part of the problem. Operational gaps inside SOCs also contribute to the issue. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=phishing-us-finance&amp;utm_term=260826&amp;utm_content=linktolanding\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN<\/a> investigation data shows how several cybersecurity pressures come together for financial-sector security teams, leading to <a href=\"https:\/\/any.run\/cybersecurity-blog\/usa-top-30-threats-2026\/\" target=\"_blank\" rel=\"noreferrer noopener\">higher phishing exposure<\/a> and heavier workloads for individual analysts. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">From these challenges also come the solutions security leaders should consider for malware &amp; phishing resilience. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Key Takeaways <\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Phishing remains a major risk for US finance, with campaigns becoming more scalable and harder to detect. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Modern phishing techniques challenge traditional defenses, increasing the need for deeper behavioral and threat visibility. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>ANY.RUN combines real-time analysis with fresh threat intelligence to help SOCs detect malicious activity earlier and investigate with greater context. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Threat data from 16K+ organizations helps financial security teams expand visibility into emerging threats and reduce risk exposure. <\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Why Phishing Puts Financial SOCs Under Particular Pressure <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The <a href=\"https:\/\/any.run\/by-industry\/finance\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=phishing-us-finance&amp;utm_term=260826&amp;utm_content=linktofinance\" target=\"_blank\" rel=\"noreferrer noopener\">finance sector<\/a> is saturated with high-value identities, transactions, and sensitive financial data. At the same time, email-heavy workflows create a large attack surface for phishing. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is reflected in what financial organizations investigate. According to <a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=phishing-us-finance&amp;utm_term=260826&amp;utm_content=linktolanding\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN<\/a>, <strong>58% of submissions from finance companies are emails<\/strong>, and <strong>14.8% of those emails are<\/strong> <strong>malicious<\/strong>. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Phishing exposure in finance is also higher than the overall benchmark. As per ANY.RUN research, <strong>72.7% of finance companies&#8217; investigations involve phishing<\/strong>. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For SOC teams, this increased exposure translates into investigation volume, contributing to heightened analyst pressure. Based on ANY.RUN&#8217;s 2026 investigation data across financial organizations, <strong>workload per analyst in finance is 24% higher than the global median<\/strong>. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Analysts also face additional pressure when it comes to the evolving, ever-changing nature of modern malware and phishing threats. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For instance, credential compromise can be mitigated comparatively easy through established authentication controls, credential resets, and account remediation. But session compromise, a method increasingly present in modern phishing campaigns like <a href=\"https:\/\/any.run\/cybersecurity-blog\/mirage2fa-phishing-targets-us-companies\/\" target=\"_blank\" rel=\"noreferrer noopener\">Mirage2FA<\/a>, creates a challenge at a more serious scale. Attackers can hijack an already authenticated session, making malicious activity harder to detect and contain. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An extra layer of pressure comes from financial organizations operating under strict <a href=\"https:\/\/any.run\/compliance\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=phishing-us-finance&amp;utm_term=260826&amp;utm_content=linktocompliance\" target=\"_blank\" rel=\"noreferrer noopener\">compliance<\/a> and investigation requirements. This makes additionalinvestigation overhead particularly costly. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Combined, these operational challenges have a very direct financial dimension. According to the FBI, business email compromise alone generated more than <strong>$55 billion in reported exposed losses globally <\/strong>between October 2013 and December 2023. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The US Factor: Higher Stakes for Financial Organizations <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The US phishing landscape overall comes with significant financial stakes. In 2025, the FBI recorded <strong>191,561 phishing and spoofing complaints,<\/strong> while <strong>business email compromise (BEC) generated more than $3 billion in reported losses.<\/strong> <\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\nReduce phishing risk with\u00a0<span class=\"highlight\">complete visibility<\/span>\n<br>\nLimit exposure through early detection with\u00a0ANY.RUN\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/any.run\/by-industry\/finance\/?utm_source=anyrunblog&#038;utm_medium=article&#038;utm_campaign=phishing-us-finance&#038;utm_term=260826&#038;utm_content=linktofinance#contact-sales\" rel=\"noopener\" target=\"_blank\">\nExplore ANY.RUN<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<p class=\"wp-block-paragraph\">The threat activity observed across financial organizations helps put this scale into context. Phishing kits such as Tycoon2FA, Sneaky2FA, EvilProxy, ClickFix, and Eviltokens are 5 of the most common threats seen in ANY.RUN investigations. In 2026 alone, leading phishing kits appeared in samples submitted for analysis by <strong>883 financial-sector organizations<\/strong> using ANY.RUN globally. <\/p>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-368\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"2\"\n           data-rows=\"6\"\n           data-wpID=\"368\"\n           data-responsive=\"0\"\n           data-has-header=\"1\">\n\n                    <thead>        <tr class=\"wpdt-cell-row \" >\n                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:50%;                    padding:10px;\n                    \"\n                    >\n                                        Malware Family\u00a0                    <\/th>\n                                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"B1\"\n                    data-col-index=\"1\"\n                    data-row-index=\"0\"\n                    style=\" width:50%;                    padding:10px;\n                    \"\n                    >\n                                        Prevalence\u00a0                    <\/th>\n                                        <\/tr>\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-underline wpdt-tc-03A9F4\"\n                                            data-cell-id=\"A2\"\n                    data-col-index=\"0\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/any.run\/cybersecurity-blog\/salty2fa-tycoon2fa-hybrid-phishing-2025\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"10\" data-link-url=\"https:\/\/any.run\/cybersecurity-blog\/salty2fa-tycoon2fa-hybrid-phishing-2025\/\" data-link-text=\"Tycoon2FA\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">Tycoon2FA<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B2\"\n                    data-col-index=\"1\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        18.7%\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-underline wpdt-tc-03A9F4\"\n                                            data-cell-id=\"A3\"\n                    data-col-index=\"0\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/any.run\/malware-trends\/sneaky2fa\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"20\" data-link-url=\"https:\/\/any.run\/malware-trends\/sneaky2fa\/\" data-link-text=\"Sneaky2FA\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">Sneaky2FA<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B3\"\n                    data-col-index=\"1\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        17.1%\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-underline wpdt-tc-03A9F4\"\n                                            data-cell-id=\"A4\"\n                    data-col-index=\"0\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/any.run\/malware-trends\/evilproxy\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"30\" data-link-url=\"https:\/\/any.run\/malware-trends\/evilproxy\/\" data-link-text=\"EvilProxy\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">EvilProxy<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B4\"\n                    data-col-index=\"1\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        13.5%\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-underline wpdt-tc-03A9F4\"\n                                            data-cell-id=\"A5\"\n                    data-col-index=\"0\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/any.run\/cybersecurity-blog\/click-fix-attacks-eric-parker-analysis\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"40\" data-link-url=\"https:\/\/any.run\/cybersecurity-blog\/click-fix-attacks-eric-parker-analysis\/\" data-link-text=\"ClickFix\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">ClickFix<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B5\"\n                    data-col-index=\"1\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        11.8%\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-underline wpdt-tc-03A9F4\"\n                                            data-cell-id=\"A6\"\n                    data-col-index=\"0\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/any.run\/cybersecurity-blog\/eviltokens-ghost-code-analysis\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"50\" data-link-url=\"https:\/\/any.run\/cybersecurity-blog\/eviltokens-ghost-code-analysis\/\" data-link-text=\"EvilTokens\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">EvilTokens<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B6\"\n                    data-col-index=\"1\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        10.5%\u00a0                    <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-368'>\ntable#wpdtSimpleTable-368{ table-layout: fixed !important; }\ntable#wpdtSimpleTable-368 td, table.wpdtSimpleTable368 th { white-space: normal !important; }\n.wpdt-tc-03A9F4 { color: #03A9F4 !important;}\n<\/style>\n\n\n\n\n<p class=\"wp-block-paragraph\">For US SOCs in particular, phishing pressure is also linked to local business and financial flows. Attackers adapt lures to events such as the US tax season, using fake tax forms, IRS-related communications, and other time-sensitive financial documents when employees are more likely to expect them. This adds another layer of credibility to attacks already designed to blend into legitimate workflows. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The same principle extends to the tools and brands employees trust every day. Attackers abuse <a href=\"https:\/\/any.run\/cybersecurity-blog\/eviltokens-ghost-code-analysis\/\" target=\"_blank\" rel=\"noreferrer noopener\">Microsoft 365<\/a>, Adobe, cloud infrastructure, document-sharing services, and other legitimate services to make malicious activity harder to separate from normal business traffic. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The result is a particularly costly combination: high phishing and BEC impact at the national level, while the threats financial SOCs investigate are becoming increasingly difficult to separate from legitimate activity. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Top Solutions for SOC Challenges in Finance <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A total of <strong>1,811 financial industry businesses use <\/strong><a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=phishing-us-finance&amp;utm_term=260826&amp;utm_content=linktolanding\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>ANY.RUN<\/strong><\/a> products to investigate threats and strengthen their security operations. Their <a href=\"https:\/\/any.run\/cybersecurity-blog\/soc-business-success-cases-anyrun\/\" target=\"_blank\" rel=\"noreferrer noopener\">success stories<\/a> demonstrate measurable improvements across key SOC workflows, driven by solutions to some of the sector\u2019s most persistent security challenges: <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. Detecting Threats Before They Spread <\/h3>\n\n\n\n<figure class=\"wp-block-pullquote\"><blockquote><p><strong>14 sec<\/strong> <\/p><cite><strong>average MTTD with ANY.RUN<\/strong> <\/cite><\/blockquote><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">As phishing infrastructure and attack techniques change rapidly, making reactive defense strategy less efficient, early detection gives security teams more time to act. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"495\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/image2.png-1024x495.webp\" alt=\"\" class=\"wp-image-22893\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/image2.png-1024x495.webp 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/image2.png-300x145.webp 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/image2.png-768x371.webp 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/image2.png-1536x742.webp 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/image2.png-370x179.webp 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/image2.png-270x130.webp 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/image2.png-740x357.webp 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/image2.png.webp 1849w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Full browser visibility within ANY.RUN Interactive Sandbox helps detect threats faster <\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">ANY.RUN combines <a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=phishing-us-finance&amp;utm_term=260826&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noreferrer noopener\">real-time behavioral analysis<\/a> with fresh threat intelligence to help analysts identify malicious activity before an initial compromise develops into a larger incident. This allows SOC teams to contain threats earlier and reduce their potential operational and financial impact. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. Catching More Evasive Threats <\/h3>\n\n\n\n<figure class=\"wp-block-pullquote\"><blockquote><p><strong>36% higher<\/strong> <\/p><cite><strong>detection rate<\/strong> with ANY.RUN<\/cite><\/blockquote><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Modern phishing increasingly abuses legitimate services and tools and relies on evasion techniques that make malicious activity harder to recognize. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"539\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-08.40.53-1024x539.png\" alt=\"\" class=\"wp-image-22894\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-08.40.53-1024x539.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-08.40.53-300x158.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-08.40.53-768x404.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-08.40.53-1536x808.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-08.40.53-2048x1078.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-08.40.53-370x195.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-08.40.53-270x142.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-08.40.53-740x389.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Phishing is a prevalent threat in cybersecurity, with diverse methods abusing trust <\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Interactive analysis exposes redirects, network connections, processes, payloads, and other behavior behind suspicious emails, URLs, and files, helping analysts uncover threats other detection may miss. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Reducing Investigation Time <\/h3>\n\n\n\n<figure class=\"wp-block-pullquote\"><blockquote><p><strong>21 min less<\/strong> <\/p><cite><strong>MTTR per investigation<\/strong> <\/cite><\/blockquote><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">In finance, slow investigations can leave more time for identity compromise, data exposure, and financial impact. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ANY.RUN gives analysts behavioral context and threat intelligence in one investigation workflow, reducing dwell time and manual work required to understand an attack and reach a reliable decision. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"539\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/TI-Reports-2048x1078.png-1024x539.webp\" alt=\"\" class=\"wp-image-22895\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/TI-Reports-2048x1078.png-1024x539.webp 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/TI-Reports-2048x1078.png-300x158.webp 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/TI-Reports-2048x1078.png-768x404.webp 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/TI-Reports-2048x1078.png-1536x809.webp 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/TI-Reports-2048x1078.png-370x195.webp 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/TI-Reports-2048x1078.png-270x142.webp 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/TI-Reports-2048x1078.png-740x390.webp 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/TI-Reports-2048x1078.png.webp 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">TI Reports on malware and phishing attacks for deeper investigations<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">To learn about the latest supply chain attacks early, SOC teams also rely on <a href=\"https:\/\/intelligence.any.run\/reports\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=phishing-us-finance&amp;utm_term=260826&amp;utm_content=linktotireports\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN\u2019s TI Reports<\/a> that provide overviews of emerging threats. Curated by an expert team of threat intelligence analysts, these reports offer actionable indicators along with recommendations on how to detect new malware strains.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Handling Higher Workloads with Fewer Escalations <\/h3>\n\n\n\n<figure class=\"wp-block-pullquote\"><blockquote><p><strong>Up to 30% fewer<\/strong> <\/p><cite><strong>Tier 1 \u2192 Tier 2 escalations<\/strong> <\/cite><\/blockquote><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">With workload per analyst 24% higher in finance than the global median, making better use of existing SOC capacity is critical. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Detailed threat context helps Tier 1 analysts validate and resolve more cases independently, keeping senior analysts focused on incidents that require deeper investigation. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">5. Turning Every Investigation Into Broader Threat Visibility <\/h3>\n\n\n\n<figure class=\"wp-block-pullquote\"><blockquote><p><strong>24\u00d7 more<\/strong> IOCs<\/p><cite><strong>for threat hunting and detection<\/strong> <\/cite><\/blockquote><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">A phishing investigation can provide value well beyond the initial verdict.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"499\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-08.43.19-1024x499.png\" alt=\"\" class=\"wp-image-22896\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-08.43.19-1024x499.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-08.43.19-300x146.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-08.43.19-768x374.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-08.43.19-1536x749.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-08.43.19-2048x998.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-08.43.19-370x180.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-08.43.19-270x132.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-08.43.19-740x361.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Threat Intelligence Feeds by ANY.RUN deliver 99% unique indicators to security stacks <\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">With <a href=\"https:\/\/any.run\/threat-intelligence-feeds\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=phishing-us-finance&amp;utm_term=260826&amp;utm_content=linktotifeedslanding\" target=\"_blank\" rel=\"noreferrer noopener\">Threat Intelligence Feeds<\/a>, ANY.RUN extracts IOCs and connects them with behavioral and threat context, providing them with intelligence to be reusedacross threat hunting, detection engineering, SIEM workflows, and future investigations. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Using <a href=\"https:\/\/any.run\/threat-intelligence-lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=phishing-us-finance&amp;utm_term=260826&amp;utm_content=linktotilookuplanding\" target=\"_blank\" rel=\"noreferrer noopener\">Threat Intelligence Lookup,<\/a> your team can also track threats by industry and region. To browse US-submitted malware samples across financial organizations, use this TI Lookup query: <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/intelligence.any.run\/analysis\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=phishing-us-finance&amp;utm_term=260826&amp;utm_content=linktotilookupquery\/lookup#{%22query%22:%22submissionCountry:%5C%22US%5C%22%20AND%20industry:%5C%22finance%5C%22%22,%22dateRange%22:180}\" target=\"_blank\" rel=\"noreferrer noopener\">submissionCountry:&#8221;US&#8221; AND industry:&#8221;finance&#8221;<\/a> <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"475\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-09.49.55-1024x475.png\" alt=\"\" class=\"wp-image-22897\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-09.49.55-1024x475.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-09.49.55-300x139.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-09.49.55-768x356.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-09.49.55-1536x712.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-09.49.55-2048x949.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-09.49.55-370x172.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-09.49.55-270x125.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Screenshot-2026-08-26-at-09.49.55-740x343.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Threat Intelligence Lookup results for US-submitted IOCs across finance companies <\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">This allows you to take the upper hand in the race against threat actors and collect live threat intelligence from 16K+ SOCs and 700K+ security experts to strengthen proactive defense against modern phishing. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">American SOC teams across finance sector operate in a high-risk environment where sophisticated threats, growing alert volumes, strict security requirements, and pressure to respond quickly all converge. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ANY.RUN helps close these gaps without increasing the amount of manual investigation required by combining interactive analysis with actionable threat intelligence. It provides analysts with opportunity to: <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Validate suspicious activity with real-time behavioral analysis in the <a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=phishing-us-finance&amp;utm_term=260826&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noreferrer noopener\">Interactive Sandbox<\/a> <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Uncover full attack behavior with process, network, and system activity visibility <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enrich IOCs with context using <a href=\"https:\/\/any.run\/threat-intelligence-lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=phishing-us-finance&amp;utm_term=260826&amp;utm_content=linktotilookuplanding\" target=\"_blank\" rel=\"noreferrer noopener\">Threat Intelligence Lookup<\/a> <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Identify related infrastructure by pivoting across connected URLs, domains, IPs, files, and analyses <\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">For financial organizations, this translates into stronger threat visibility, faster and more confident investigations, and less operational pressure on SOC teams. <\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\nTurn threat data from <span class=\"highlight\">16K+<\/span> orgs into stronger protection.\u00a0\n<br>\nDetect phishing activity before it\u00a0impacts\u00a0your business.\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/any.run\/by-industry\/finance\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=phishing-us-finance&amp;utm_term=260826&amp;utm_content=linktofinance#contact-sales\" rel=\"noopener\" target=\"_blank\">\nStrengthen Your SOC<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<p class=\"wp-block-paragraph\">With threat data continuously generated across 16K+ organizations and an average MTTD of 14 seconds, ANY.RUN helps security teams detect threats earlier, reduce exposure, and protect critical financial systems and customer data. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">About ANY.RUN <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=phishing-us-finance&amp;utm_term=260826&amp;utm_content=linktolanding\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN<\/a> is a leading provider of interactive malware analysis and threat intelligence solutions, helping organizations investigate threats faster and make informed response decisions based on clear behavioral evidence. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Its solutions include the <a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=phishing-us-finance&amp;utm_term=260826&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noreferrer noopener\">Interactive Sandbox<\/a> for enterprise-scale malware and phishing analysis, as well as Threat Intelligence products powered by investigation data from more than 16,000 organizations. This intelligence enables security teams to enrich alerts, identify emerging threats earlier, and bring relevant context into detection, investigation, and response workflows. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ANY.RUN is <a href=\"https:\/\/any.run\/compliance\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=phishing-us-finance&amp;utm_term=260826&amp;utm_content=linktocompliance\" target=\"_blank\" rel=\"noreferrer noopener\">SOC 2 Type II attested<\/a>, reflecting its commitment to robust security controls and customer data protection. For SOCs, <a href=\"https:\/\/any.run\/mssp\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=phishing-us-finance&amp;utm_term=260826&amp;utm_content=linktomssp\" target=\"_blank\" rel=\"noreferrer noopener\">MSSPs<\/a>, and <a href=\"https:\/\/any.run\/enterprise\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=phishing-us-finance&amp;utm_term=260826&amp;utm_content=linktoenterprise\" target=\"_blank\" rel=\"noreferrer noopener\">enterprise<\/a> security teams, ANY.RUN helps reduce investigation uncertainty, speed up triage, and turn threat analysis into actionable security decisions. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>With modern campaigns such as Vercel-hosted RMM attacks, the scale and security impact of phishing in US finance should not be understated. As threats get increasingly harder to detect, the phishing challenge raises the stakes in the industry. Legitimate services and tools used in daily workflows across corporate America are increasingly abused to deliver phishing [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":22891,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[4],"tags":[57,10,34],"class_list":["post-22886","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-lifehacks","tag-anyrun","tag-cybersecurity","tag-malware-analysis"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>US Finance Faces a Growing Phishing Threat<\/title>\n<meta name=\"description\" content=\"See the threats financial SOCs across the US face and how deeper visibility from ANY.RUN helps reduce risk.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/any.run\/cybersecurity-blog\/phishing-us-finance\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"ANY.RUN\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/phishing-us-finance\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/phishing-us-finance\\\/\"},\"author\":{\"name\":\"ANY.RUN\",\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"headline\":\"US Finance Under Phishing Pressure: What the SOC Data Reveals?\",\"datePublished\":\"2026-08-26T09:17:40+00:00\",\"dateModified\":\"2026-08-26T09:21:13+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/phishing-us-finance\\\/\"},\"wordCount\":1511,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"image\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/phishing-us-finance\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/Cyber-Threats-to-US-Finance-scaled.png\",\"keywords\":[\"ANYRUN\",\"cybersecurity\",\"malware analysis\"],\"articleSection\":[\"Cybersecurity Lifehacks\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/phishing-us-finance\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/phishing-us-finance\\\/\",\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/phishing-us-finance\\\/\",\"name\":\"US Finance Faces a Growing Phishing Threat\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/phishing-us-finance\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/phishing-us-finance\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/Cyber-Threats-to-US-Finance-scaled.png\",\"datePublished\":\"2026-08-26T09:17:40+00:00\",\"dateModified\":\"2026-08-26T09:21:13+00:00\",\"description\":\"See the threats financial SOCs across the US face and how deeper visibility from ANY.RUN helps reduce risk.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/phishing-us-finance\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/phishing-us-finance\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/phishing-us-finance\\\/#primaryimage\",\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/Cyber-Threats-to-US-Finance-scaled.png\",\"contentUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/Cyber-Threats-to-US-Finance-scaled.png\",\"width\":2560,\"height\":1243,\"caption\":\"American phishing\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/phishing-us-finance\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cybersecurity Lifehacks\",\"item\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/category\\\/lifehacks\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"US Finance Under Phishing Pressure: What the SOC Data Reveals?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/any.run\\\/\",\"url\":\"https:\\\/\\\/any.run\\\/\",\"name\":\"ANY.RUN&#039;s Cybersecurity Blog\",\"description\":\"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.\",\"publisher\":{\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/any.run\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/any.run\\\/\",\"name\":\"ANY.RUN\",\"url\":\"https:\\\/\\\/any.run\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/any.run\\\/\",\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/ANYRUN-Icon.svg\",\"contentUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/ANYRUN-Icon.svg\",\"width\":1,\"height\":1,\"caption\":\"ANY.RUN\"},\"image\":{\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/www.any.run\\\/\",\"https:\\\/\\\/x.com\\\/anyrun_app\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/30692044\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCOgCPho7lzmH7m6fPNlukrQ\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/any.run\\\/\",\"name\":\"ANY.RUN\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g\",\"caption\":\"ANY.RUN\"},\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/author\\\/a-bespalova\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"US Finance Faces a Growing Phishing Threat","description":"See the threats financial SOCs across the US face and how deeper visibility from ANY.RUN helps reduce risk.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/any.run\/cybersecurity-blog\/phishing-us-finance\/","twitter_misc":{"Written by":"ANY.RUN","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/any.run\/cybersecurity-blog\/phishing-us-finance\/#article","isPartOf":{"@id":"https:\/\/any.run\/cybersecurity-blog\/phishing-us-finance\/"},"author":{"name":"ANY.RUN","@id":"https:\/\/any.run\/"},"headline":"US Finance Under Phishing Pressure: What the SOC Data Reveals?","datePublished":"2026-08-26T09:17:40+00:00","dateModified":"2026-08-26T09:21:13+00:00","mainEntityOfPage":{"@id":"https:\/\/any.run\/cybersecurity-blog\/phishing-us-finance\/"},"wordCount":1511,"commentCount":0,"publisher":{"@id":"https:\/\/any.run\/"},"image":{"@id":"https:\/\/any.run\/cybersecurity-blog\/phishing-us-finance\/#primaryimage"},"thumbnailUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Cyber-Threats-to-US-Finance-scaled.png","keywords":["ANYRUN","cybersecurity","malware analysis"],"articleSection":["Cybersecurity Lifehacks"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/any.run\/cybersecurity-blog\/phishing-us-finance\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/any.run\/cybersecurity-blog\/phishing-us-finance\/","url":"https:\/\/any.run\/cybersecurity-blog\/phishing-us-finance\/","name":"US Finance Faces a Growing Phishing Threat","isPartOf":{"@id":"https:\/\/any.run\/"},"primaryImageOfPage":{"@id":"https:\/\/any.run\/cybersecurity-blog\/phishing-us-finance\/#primaryimage"},"image":{"@id":"https:\/\/any.run\/cybersecurity-blog\/phishing-us-finance\/#primaryimage"},"thumbnailUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Cyber-Threats-to-US-Finance-scaled.png","datePublished":"2026-08-26T09:17:40+00:00","dateModified":"2026-08-26T09:21:13+00:00","description":"See the threats financial SOCs across the US face and how deeper visibility from ANY.RUN helps reduce risk.","breadcrumb":{"@id":"https:\/\/any.run\/cybersecurity-blog\/phishing-us-finance\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/any.run\/cybersecurity-blog\/phishing-us-finance\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/cybersecurity-blog\/phishing-us-finance\/#primaryimage","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Cyber-Threats-to-US-Finance-scaled.png","contentUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/08\/Cyber-Threats-to-US-Finance-scaled.png","width":2560,"height":1243,"caption":"American phishing"},{"@type":"BreadcrumbList","@id":"https:\/\/any.run\/cybersecurity-blog\/phishing-us-finance\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/any.run\/cybersecurity-blog\/"},{"@type":"ListItem","position":2,"name":"Cybersecurity Lifehacks","item":"https:\/\/any.run\/cybersecurity-blog\/category\/lifehacks\/"},{"@type":"ListItem","position":3,"name":"US Finance Under Phishing Pressure: What the SOC Data Reveals?"}]},{"@type":"WebSite","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/","name":"ANY.RUN&#039;s Cybersecurity Blog","description":"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.","publisher":{"@id":"https:\/\/any.run\/"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/any.run\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/any.run\/","name":"ANY.RUN","url":"https:\/\/any.run\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","contentUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","width":1,"height":1,"caption":"ANY.RUN"},"image":{"@id":"https:\/\/any.run\/"},"sameAs":["https:\/\/www.facebook.com\/www.any.run\/","https:\/\/x.com\/anyrun_app","https:\/\/www.linkedin.com\/company\/30692044","https:\/\/www.youtube.com\/channel\/UCOgCPho7lzmH7m6fPNlukrQ"]},{"@type":"Person","@id":"https:\/\/any.run\/","name":"ANY.RUN","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g","caption":"ANY.RUN"},"url":"https:\/\/any.run\/cybersecurity-blog\/author\/a-bespalova\/"}]}},"_links":{"self":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/22886","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/comments?post=22886"}],"version-history":[{"count":9,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/22886\/revisions"}],"predecessor-version":[{"id":22904,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/22886\/revisions\/22904"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media\/22891"}],"wp:attachment":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media?parent=22886"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/categories?post=22886"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/tags?post=22886"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}