[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBT9MB7k_OKs6k5RXpZPl4M3TioLWrV4olYtjOXwWb7k":3},{"article":4,"iocs":49,"watch_terms":57,"solutions":58,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"1d03b967-982c-442d-b0f5-5d20b93cf3a2","AI-Powered Malware Analysis: From Hidden Phishing Attacks to Faster SOC Response","ai-powered-malware-analysis-from-hidden-phishing-attacks-to-faster-soc-response-479172","A suspicious PDF opens normally. The link inside leads to a CAPTCHA page. Nothing obviously malicious appears, yet the real attack is still several steps away. For SOC analysts, cases like this can turn a routine phishing alert into a lengthy investigation. Following redirects, examining network activity, checking related infrastructure, and preparing evidence for escalation […] The post AI-Powered Malware Analysis: From Hidden Phishing Attacks to Faster SOC Response appeared first on Cyber Security News.","ANY.RUN has introduced AI-powered features to its malware analysis sandbox, aiming to accelerate Security Operations Center (SOC) response times to sophisticated phishing attacks. The platform's AI-assisted automated interactivity can navigate complex attack chains, including CAPTCHA challenges and Microsoft OAuth phishing flows, while allowing analysts to interact and inspect at any stage. Additionally, a new Related Threat Context capability correlates findings with over 70 previous sandbox analyses, linking suspicious indicators to known campaigns like SkyW4lker and associated infrastructure.","ANY.RUN enhances malware analysis with AI, speeding up SOC response to complex phishing attacks.","https:\u002F\u002Fcybersecuritynews.com\u002Fai-powered-malware-analysis\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fai-malware-analysis-banner-1600x900-1.webp","2026-11-10T15:47:38+00:00","2026-11-10T16:00:31.19061+00:00",7,[17,20,23],{"name":18,"type":19},"ANY.RUN","product",{"name":21,"type":22},"AI","technology",{"name":24,"type":25},"SkyW4lker","campaign","02371804-cf6d-4449-98de-f1a2d4d9b266",{"id":26,"icon":28,"name":29,"slug":30},null,"Tools","tools",[32,34,39,44],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54],{"type":51,"value":52,"context":53},"domain","slybee.com","Suspicious domain identified during analysis, linked to SkyW4lker campaign.",{"type":55,"value":24,"context":56},"malware","Phishing campaign identified through threat intelligence lookup.",[18],{"controls":59,"vendors":146},[60,89,117],{"slug":61,"name":62,"problem":63,"products":64},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":48,"name":90,"problem":91,"products":92},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"slug":118,"name":119,"problem":120,"products":121},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",[],{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":157},"ai-powered-sandbox-analysis-accelerates-soc-response-to-sophisticated-phishing-campaigns","AI-Powered Sandbox Analysis Accelerates SOC Response to Sophisticated Phishing Campaigns","Modern phishing attacks have grown significantly more complex, incorporating CAPTCHA challenges, OAuth abuse, and multi-stage attack chains that overwhelm traditional manual analysis workflows in SOC environments. The gap between attack sophistication and analyst capacity creates dangerous delays in detection and response, allowing threats to persist longer in environments. AI-assisted malware analysis tools can automate navigation of these complex attack flows, correlate findings across thousands of previous analyses, and surface threat intelligence connections to known campaigns far faster than human analysts alone. This matters because speed of detection and context-rich triage directly determine how much damage a threat actor can inflict before containment.",[152,153,154,155,156],"NIST CSF 2.0 DE.CM-01: Continuous Monitoring","NIST CSF 2.0 RS.AN-03: Incident Analysis","CIS Control 9: Email and Web Browser Protections (v8)","NIST SP 800-53 IR-4: Incident Handling","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":158,"NIST SP 800-53 IR-4: Incident Handling":159,"NIST CSF 2.0 RS.AN-03: Incident Analysis":160,"NIST CSF 2.0 DE.CM-01: Continuous Monitoring":161,"CIS Control 9: Email and Web Browser Protections (v8)":162},"This point requires entities to implement incident handling procedures; the article highlights that AI-assisted tooling reduces response time gaps that undermine effective incident handling against sophisticated phishing attacks.","IR-4 requires organizations to implement incident handling capabilities that include containment, eradication, and recovery; faster SOC triage enabled by AI analysis directly supports the timeliness requirements of this control.","This category requires organizations to analyze incidents to understand their scope and impact; automated correlation of sandbox findings to known threat campaigns like SkyW4lker accelerates exactly this analysis step.","This category calls for continuous monitoring of networks and systems for adverse events; AI-powered sandbox analysis directly extends that monitoring capability to complex phishing payloads that evade signature-based detection.","CIS Control 9 requires organizations to improve protections against threats delivered through email and web browsers, which is directly addressed by sandboxing and AI-assisted analysis of phishing attack chains including OAuth flows."]