{"id":5960,"date":"2023-10-11T08:42:21","date_gmt":"2023-10-11T08:42:21","guid":{"rendered":"\/cybersecurity-blog\/?p=5960"},"modified":"2025-01-31T08:30:40","modified_gmt":"2025-01-31T08:30:40","slug":"new-phishing-tactics","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/new-phishing-tactics\/","title":{"rendered":"Captchas, QR codes, and Clever Evasion: New Phishing Tactics are Gaining Traction\u00a0"},"content":{"rendered":"\n<p>Several sophisticated phishing campaigns are currently spreading fast that pose challenges for detection.&nbsp;<\/p>\n\n\n\n<p>Crooks are increasingly using&nbsp;captchas and QR codes to mask malicious content. The goal is adding another step, which requires human interaction \u2014 instead of directly embedding or linking to a payload or using elements that bypass email spam filters, as is the case with &#8220;quishing&#8221;.&nbsp;<\/p>\n\n\n\n<p>As of this writing, you can easily find examples of these campaigns on <a href=\"https:\/\/app.any.run\/submissions\/#tag:phishing\" target=\"_blank\" rel=\"noreferrer noopener\">ANY. RUN&#8217;s public submissions<\/a> database. We&#8217;re observing more than 2,000 phishing attempts each week, with activity spiking as we approach Friday. Here&#8217;s the data for the week of September 30 to October 6:&nbsp;<\/p>\n\n\n\n<p>Number of public submissions with <strong>phishing <\/strong>tag:&nbsp;<\/p>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-32\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"2\"\n           data-rows=\"8\"\n           data-wpID=\"32\"\n           data-responsive=\"0\"\n           data-has-header=\"1\">\n\n                    <thead>        <tr class=\"wpdt-cell-row \" >\n                                <th class=\"wpdt-cell wpdt-align-left wpdt-bold\"\n                                            data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:50%;                    padding:10px;\n                    \"\n                    >\n                                        Number of tasks\u00a0                    <\/th>\n                                                <th class=\"wpdt-cell wpdt-align-left wpdt-bold\"\n                                            data-cell-id=\"B1\"\n                    data-col-index=\"1\"\n                    data-row-index=\"0\"\n                    style=\" width:50%;                    padding:10px;\n                    \"\n                    >\n                                        Day of the week\u00a0                    <\/th>\n                                        <\/tr>\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"A2\"\n                    data-col-index=\"0\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        572\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"B2\"\n                    data-col-index=\"1\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Friday, 10.06\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"A3\"\n                    data-col-index=\"0\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        438\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"B3\"\n                    data-col-index=\"1\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Thursday, 10.05\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"A4\"\n                    data-col-index=\"0\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        400\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"B4\"\n                    data-col-index=\"1\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Wednesday, 10.04\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"A5\"\n                    data-col-index=\"0\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        310\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"B5\"\n                    data-col-index=\"1\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Tuesday, 10.03\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"A6\"\n                    data-col-index=\"0\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        189\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"B6\"\n                    data-col-index=\"1\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Monday, 10.02\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"A7\"\n                    data-col-index=\"0\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        22\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"B7\"\n                    data-col-index=\"1\"\n                    data-row-index=\"6\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Sunday, 10.01\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"A8\"\n                    data-col-index=\"0\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        88\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-align-left\"\n                                            data-cell-id=\"B8\"\n                    data-col-index=\"1\"\n                    data-row-index=\"7\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Saturday, 09.30\u00a0                    <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-32'>\ntable#wpdtSimpleTable-32{ table-layout: fixed !important; }\ntable#wpdtSimpleTable-32 td, table.wpdtSimpleTable32 th { white-space: normal !important; }\n<\/style>\n\n\n\n\n<p>In this article, we&#8217;ll examine three new phishing techniques: captchas, QR codes, and emails that link to password-protected payloads hosted on file-sharing services, with the password provided in the email body itself.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A phishing campaign uses captchas to stall analysis<\/h2>\n\n\n\n<p>Hackers are increasingly using legitimate tools to make their campaigns appear more credible. But now, they&#8217;ve taken it a step further by using actual security solutions in their attacks.&nbsp;<\/p>\n\n\n\n<p>The attack \u2014 which begins like a standard credential harvesting attempt and targets O365 credentials&nbsp;\u2014 uses a spam email as an initial vector. Hackers lure the user into logging into what appears to be legitimate software. &nbsp;<\/p>\n\n\n\n<p>The attackers use the Cyber Panel\u2014an open-source web development panel\u2014to create hundreds of cryptic domain names daily using a Randomized Domain Generated Algorithm (RDGA). These domains host credential-harvesting pages. Because the domains are highly randomized, hosting providers find it challenging to locate and shut them down.<\/p>\n\n\n\n<p><a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=newphishing11102023&amp;utm_content=landing\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN<\/a>\u2019s security researcher <a href=\"https:\/\/twitter.com\/Jane_0sint\" target=\"_blank\" rel=\"noreferrer noopener\">@Jane_0sint<\/a> has written a RegEx rule to identify these domains:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"900\" height=\"905\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/janetweet.png\" alt=\"\" class=\"wp-image-5973\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/janetweet.png 900w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/janetweet-298x300.png 298w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/janetweet-150x150.png 150w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/janetweet-768x772.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/janetweet-70x70.png 70w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/janetweet-370x372.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/janetweet-270x272.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/janetweet-740x744.png 740w\" sizes=\"(max-width: 900px) 100vw, 900px\" \/><figcaption class=\"wp-element-caption\"><a href=\"https:\/\/twitter.com\/Jane_0sint\/status\/1707654820281172239\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/twitter.com\/Jane_0sint\/status\/1707654820281172239<\/a><\/figcaption><\/figure>\n\n\n\n<p>The credential harvesting forms are concealed behind CloudFlare&#8217;s Turnstile service:\u00a0<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"590\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/captcha-1-min-1024x590.png\" alt=\"\" class=\"wp-image-5974\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/captcha-1-min-1024x590.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/captcha-1-min-300x173.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/captcha-1-min-768x442.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/captcha-1-min-1536x885.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/captcha-1-min-2048x1180.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/captcha-1-min-370x213.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/captcha-1-min-270x156.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/captcha-1-min-740x426.png 740w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>By putting CloudFlare&#8217;s legitimate captcha in front of malicious content, the attackers are essentially pitting one security system against another \u2014 that&#8217;s because automated security solutions, like web crawlers designed for threat detection, get stopped by the captcha. As a result, the content evades being flagged as malicious, and emails with links to this page slip through spam filters.\u00a0Attacks involving CAPTCHA target individual users, using the challenge as a way to ensure that actual victims rather than bots are interacting with the malicious content. It&#8217;s worth noting that attackers do not use CAPTCHA codes in this campaign.<\/p>\n\n\n\n<p>But this attack is more than just one of CAPTCHA scams.\u00a0<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"590\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/captcha-2-min-1024x590.png\" alt=\"\" class=\"wp-image-5975\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/captcha-2-min-1024x590.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/captcha-2-min-300x173.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/captcha-2-min-768x443.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/captcha-2-min-1536x885.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/captcha-2-min-2048x1181.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/captcha-2-min-370x213.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/captcha-2-min-270x156.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/captcha-2-min-740x427.png 740w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Attackers append the victim&#8217;s email address as a GET parameter after the target completes the captcha. They then execute a script to extract the domain name of the target&#8217;s organization, using this data to display a custom login page that mimics the victim&#8217;s actual login portal.&nbsp;<\/p>\n\n\n\n<p>In <a href=\"https:\/\/app.any.run\/tasks\/22b677ed-8ee9-4c25-81c0-fd9073540009\/?utm_source=anyrunblog&amp;utm_medium=article_bottom&amp;utm_campaign=newphishing11102023&amp;utm_content=task\" target=\"_blank\" rel=\"noreferrer noopener\">this example<\/a>, the targeted organization is Halliburton Corporation.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"588\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-6-1024x588.png\" alt=\"\" class=\"wp-image-5961\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-6-1024x588.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-6-300x172.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-6-768x441.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-6-1536x881.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-6-370x212.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-6-270x155.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-6-740x425.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-6.png 1600w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>The target, who likely sees this interface almost daily, has few cues to raise suspicion, making it very difficult to realize that they are being scammed.&nbsp;<\/p>\n\n\n\n<p>The realistic Office 365 private login page is provided by Dadsec. This is part of their Phishing as a Service (PhaaS) platform, and it has been distributed through Telegram since January 2023.&nbsp;<\/p>\n\n\n\n<p>After the victim lands on the login page, the remainder of the attack follows a standard credential harvesting pattern. Once the victim enters their login credentials, a &#8220;wrong credentials&#8221; error message is displayed. The attackers then quickly redirect the victim to a legitimate website, while exfiltrating the credentials to their Command-and-Control server.&nbsp;<\/p>\n\n\n\n<p>This poses challenges for investigation as well, given that not all automated sandboxes can bypass a captcha. This is where the interactivity in ANY.RUN becomes valuable \u2014 you can manually complete the captcha within the Virtual Machine&nbsp;view and see the most interesting aspects of the attack.<\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\nAnalyze complex <span class=\"highlight\">phishing and malware campaigns<\/span> in ANY.RUN cloud sandbox&nbsp;\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/app.any.run\/#register\" rel=\"noopener\" target=\"_blank\">\nSign up free\u00a0\n<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<h2 class=\"wp-block-heading\">Quishing, a variation of phishing, uses QR codes to evade detection&nbsp;<\/h2>\n\n\n\n<p>Quishing \u2014 derived from combining words QR and phishing \u2014 is a phishing strategy that has been gaining popularity since late summer of 2023.\u00a0<\/p>\n\n\n\n<p>The quishing definition is an attack that involves criminals sending a QR code that redirects the target to a malicious website. Embedding the malicious link within a QR code helps the attacker bypass spam filters, as QR codes are generally considered safe, and many security tools lack the capability to parse their content.\u00a0<\/p>\n\n\n\n<p>Emails are often the initial point of contact in quishing campaigns.&nbsp;In the example below, the attackers combine the common trope of a fake payment invoice email and quishing:&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"590\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/qr-1-min-1024x590.png\" alt=\"\" class=\"wp-image-5976\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/qr-1-min-1024x590.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/qr-1-min-300x173.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/qr-1-min-768x443.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/qr-1-min-1536x886.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/qr-1-min-2048x1181.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/qr-1-min-370x213.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/qr-1-min-270x156.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/qr-1-min-740x427.png 740w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>ANY.RUN currently can&#8217;t extract URLs from QR codes, so initially it misses detecting the phishing attempt, as indicated in the screenshot above. However, you can very easily save the QR code and upload it to a third-party QR scanning service to extract the URL:&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"592\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/qr-2-min-1024x592.png\" alt=\"\" class=\"wp-image-5977\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/qr-2-min-1024x592.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/qr-2-min-300x173.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/qr-2-min-768x444.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/qr-2-min-1536x888.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/qr-2-min-2048x1184.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/qr-2-min-370x214.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/qr-2-min-270x156.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/qr-2-min-740x428.png 740w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>We used qrcoderaptor[.]com to pull the URL:&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"589\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-8-1024x589.png\" alt=\"\" class=\"wp-image-5966\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-8-1024x589.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-8-300x173.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-8-768x442.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-8-1536x883.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-8-370x213.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-8-270x155.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-8-740x426.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-8.png 1600w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>After following the link sandboxing confirms malicious intent and phishing is detected:&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"591\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-7-1024x591.png\" alt=\"\" class=\"wp-image-5968\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-7-1024x591.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-7-300x173.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-7-768x443.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-7-1536x886.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-7-370x213.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-7-270x156.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-7-740x427.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-7.png 1600w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Another phishing campaign bypasses detection with a combo of evasion techniques&nbsp;<\/h2>\n\n\n\n<p>In another campaign we recently observed, threat actors combine well-known phishing methods in a clever way to sidestep detection from automated sandboxes.&nbsp;<\/p>\n\n\n\n<p><a href=\"https:\/\/app.any.run\/tasks\/ea59c5c9-2573-4100-8a48-dcbe491e3e7f\/?utm_source=anyrunblog&amp;utm_medium=article_bottom&amp;utm_campaign=newphishing11102023&amp;utm_content=task\" target=\"_blank\" rel=\"noreferrer noopener\">This attack<\/a> kicks off with a phishing email disguised as a judicial court notification from the Republic of Colombia. Attached to the email is what appears to be a PDF, but is in fact an image designed to mimic a file:&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"584\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-9-1024x584.png\" alt=\"\" class=\"wp-image-5971\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-9-1024x584.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-9-300x171.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-9-768x438.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-9-1536x876.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-9-370x211.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-9-270x154.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-9-740x422.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-9.png 1600w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>When clicked, the image redirects the user to a file hosted online:&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"585\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/evasion-2-min-1024x585.png\" alt=\"\" class=\"wp-image-5978\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/evasion-2-min-1024x585.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/evasion-2-min-300x171.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/evasion-2-min-768x438.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/evasion-2-min-1536x877.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/evasion-2-min-2048x1169.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/evasion-2-min-370x211.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/evasion-2-min-270x154.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/evasion-2-min-740x422.png 740w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>The file is encrypted, and password-protected. The password for this archive is provided in the body of the email.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"582\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-10-1024x582.png\" alt=\"\" class=\"wp-image-5972\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-10-1024x582.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-10-300x171.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-10-768x437.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-10-1536x874.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-10-370x210.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-10-270x154.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-10-740x421.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2023\/10\/image-10.png 1600w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Using images as fake attachments is a tactic that&#8217;s been around, probably, since the mid-2010s, and delivering payloads in password protected archives is an even older trick. However, combining them together like this is a powerful way to evade automated analysis.&nbsp;<\/p>\n\n\n\n<p>A security orchestration platform would need to recognize the clickable image, download the file from a hosting service, locate the password within the email, and then decrypt the archive using that password. This scenario is easy for a human, but tough to replicate reliably with automation.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Detecting and Analyzing QUISHING in ANY.RUN\" width=\"770\" height=\"433\" src=\"https:\/\/www.youtube.com\/embed\/xjB6TA-Qc3s?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">How to detect these phishing campaigns: our recommendations&nbsp;<\/h2>\n\n\n\n<p>These three examples underscore that attackers don&#8217;t always need groundbreaking techniques to run impactful campaigns. By smartly combining existing tools, they achieve a high impact with minimal effort.&nbsp;<\/p>\n\n\n\n<p>It seems the attackers are exploiting the limitations of automated security systems, particularly those lacking dynamic analysis capabilities. We recommend incorporating a malware sandbox into your security workflow for dynamic analysis, allowing you to safely engage with and scrutinize the malicious content.&nbsp;<\/p>\n\n\n\n<p>For ANY.RUN users, analyzing these campaigns is simplified, since they get direct, real-time access to our cloud virtual machines during task execution.&nbsp;<\/p>\n\n\n\n<p><strong>About ANY.RUN<\/strong>&nbsp;<\/p>\n\n\n\n<p>ANY.RUN is a cloud malware sandbox that handles the heavy lifting of malware analysis for SOC and DFIR teams. Every day, 300,000 professionals use our platform to investigate incidents and streamline threat analysis.&nbsp;&nbsp;<\/p>\n\n\n\n<p>Request a demo today and enjoy 14 days of free access to our Enterprise plan.&nbsp;&nbsp;&nbsp;<\/p>\n\n\n\n<p><a href=\"https:\/\/any.run\/demo\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=newphishing11102023&amp;utm_content=demo\" target=\"_blank\" rel=\"noreferrer noopener\">Request demo \u2192<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Several sophisticated phishing campaigns are currently spreading fast that pose challenges for detection.&nbsp; Crooks are increasingly using&nbsp;captchas and QR codes to mask malicious content. The goal is adding another step, which requires human interaction \u2014 instead of directly embedding or linking to a payload or using elements that bypass email spam filters, as is the [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":5984,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[57,10,34,40],"class_list":["post-5960","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-lifehacks","tag-anyrun","tag-cybersecurity","tag-malware-analysis","tag-malware-behavior"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.10 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Captchas, QR codes, and Clever Evasion: New Phishing Tactics<\/title>\n<meta name=\"description\" content=\"Discover how hackers are using captchas and QR codes to mask malicious content as part of sophisticated phishing campaigns.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/any.run\/cybersecurity-blog\/new-phishing-tactics\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"y.shvetsov\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/new-phishing-tactics\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/new-phishing-tactics\/\"},\"author\":{\"name\":\"y.shvetsov\",\"@id\":\"https:\/\/any.run\/\"},\"headline\":\"Captchas, QR codes, and Clever Evasion: New Phishing Tactics are Gaining Traction\u00a0\",\"datePublished\":\"2023-10-11T08:42:21+00:00\",\"dateModified\":\"2025-01-31T08:30:40+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/new-phishing-tactics\/\"},\"wordCount\":1226,\"commentCount\":1,\"publisher\":{\"@id\":\"https:\/\/any.run\/\"},\"keywords\":[\"ANYRUN\",\"cybersecurity\",\"malware analysis\",\"malware behavior\"],\"articleSection\":[\"Cybersecurity Lifehacks\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/any.run\/cybersecurity-blog\/new-phishing-tactics\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/new-phishing-tactics\/\",\"url\":\"https:\/\/any.run\/cybersecurity-blog\/new-phishing-tactics\/\",\"name\":\"Captchas, QR codes, and Clever Evasion: New Phishing Tactics\",\"isPartOf\":{\"@id\":\"https:\/\/any.run\/\"},\"datePublished\":\"2023-10-11T08:42:21+00:00\",\"dateModified\":\"2025-01-31T08:30:40+00:00\",\"description\":\"Discover how hackers are using captchas and QR codes to mask malicious content as part of sophisticated phishing campaigns.\",\"breadcrumb\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/new-phishing-tactics\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/any.run\/cybersecurity-blog\/new-phishing-tactics\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/new-phishing-tactics\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/any.run\/cybersecurity-blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cybersecurity Lifehacks\",\"item\":\"https:\/\/any.run\/cybersecurity-blog\/category\/lifehacks\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Captchas, QR codes, and Clever Evasion: New Phishing Tactics are Gaining Traction\u00a0\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/any.run\/\",\"name\":\"ANY.RUN&#039;s Cybersecurity Blog\",\"description\":\"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.\",\"publisher\":{\"@id\":\"https:\/\/any.run\/\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/any.run\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/any.run\/\",\"name\":\"ANY.RUN\",\"url\":\"https:\/\/any.run\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg\",\"contentUrl\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg\",\"width\":1,\"height\":1,\"caption\":\"ANY.RUN\"},\"image\":{\"@id\":\"https:\/\/any.run\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/www.any.run\/\",\"https:\/\/twitter.com\/anyrun_app\",\"https:\/\/www.linkedin.com\/company\/30692044\",\"https:\/\/www.youtube.com\/channel\/UCOgCPho7lzmH7m6fPNlukrQ\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/any.run\/\",\"name\":\"y.shvetsov\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d0d0a5df59078efed19ba1b45c4fb721?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d0d0a5df59078efed19ba1b45c4fb721?s=96&d=mm&r=g\",\"caption\":\"y.shvetsov\"},\"url\":\"https:\/\/any.run\/cybersecurity-blog\/author\/y-shvetsov\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Captchas, QR codes, and Clever Evasion: New Phishing Tactics","description":"Discover how hackers are using captchas and QR codes to mask malicious content as part of sophisticated phishing campaigns.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/any.run\/cybersecurity-blog\/new-phishing-tactics\/","twitter_misc":{"Written by":"y.shvetsov","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/any.run\/cybersecurity-blog\/new-phishing-tactics\/#article","isPartOf":{"@id":"https:\/\/any.run\/cybersecurity-blog\/new-phishing-tactics\/"},"author":{"name":"y.shvetsov","@id":"https:\/\/any.run\/"},"headline":"Captchas, QR codes, and Clever Evasion: New Phishing Tactics are Gaining Traction\u00a0","datePublished":"2023-10-11T08:42:21+00:00","dateModified":"2025-01-31T08:30:40+00:00","mainEntityOfPage":{"@id":"https:\/\/any.run\/cybersecurity-blog\/new-phishing-tactics\/"},"wordCount":1226,"commentCount":1,"publisher":{"@id":"https:\/\/any.run\/"},"keywords":["ANYRUN","cybersecurity","malware analysis","malware behavior"],"articleSection":["Cybersecurity Lifehacks"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/any.run\/cybersecurity-blog\/new-phishing-tactics\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/any.run\/cybersecurity-blog\/new-phishing-tactics\/","url":"https:\/\/any.run\/cybersecurity-blog\/new-phishing-tactics\/","name":"Captchas, QR codes, and Clever Evasion: New Phishing Tactics","isPartOf":{"@id":"https:\/\/any.run\/"},"datePublished":"2023-10-11T08:42:21+00:00","dateModified":"2025-01-31T08:30:40+00:00","description":"Discover how hackers are using captchas and QR codes to mask malicious content as part of sophisticated phishing campaigns.","breadcrumb":{"@id":"https:\/\/any.run\/cybersecurity-blog\/new-phishing-tactics\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/any.run\/cybersecurity-blog\/new-phishing-tactics\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/any.run\/cybersecurity-blog\/new-phishing-tactics\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/any.run\/cybersecurity-blog\/"},{"@type":"ListItem","position":2,"name":"Cybersecurity Lifehacks","item":"https:\/\/any.run\/cybersecurity-blog\/category\/lifehacks\/"},{"@type":"ListItem","position":3,"name":"Captchas, QR codes, and Clever Evasion: New Phishing Tactics are Gaining Traction\u00a0"}]},{"@type":"WebSite","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/","name":"ANY.RUN&#039;s Cybersecurity Blog","description":"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.","publisher":{"@id":"https:\/\/any.run\/"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/any.run\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/any.run\/","name":"ANY.RUN","url":"https:\/\/any.run\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","contentUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","width":1,"height":1,"caption":"ANY.RUN"},"image":{"@id":"https:\/\/any.run\/"},"sameAs":["https:\/\/www.facebook.com\/www.any.run\/","https:\/\/twitter.com\/anyrun_app","https:\/\/www.linkedin.com\/company\/30692044","https:\/\/www.youtube.com\/channel\/UCOgCPho7lzmH7m6fPNlukrQ"]},{"@type":"Person","@id":"https:\/\/any.run\/","name":"y.shvetsov","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/","url":"https:\/\/secure.gravatar.com\/avatar\/d0d0a5df59078efed19ba1b45c4fb721?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d0d0a5df59078efed19ba1b45c4fb721?s=96&d=mm&r=g","caption":"y.shvetsov"},"url":"https:\/\/any.run\/cybersecurity-blog\/author\/y-shvetsov\/"}]}},"_links":{"self":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/5960"}],"collection":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/comments?post=5960"}],"version-history":[{"count":10,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/5960\/revisions"}],"predecessor-version":[{"id":11409,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/5960\/revisions\/11409"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media\/5984"}],"wp:attachment":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media?parent=5960"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/categories?post=5960"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/tags?post=5960"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}