April 2025: Cybercriminals Dial Up the Deception
Cyber threats didn’t take a break in April—in fact, they got bolder. From fake CAPTCHAs that do more than just test your humanity to phishing campaigns tailored by geography, threat actors showcased new levels of creativity and precision. Ransomware also got a makeover, slipping under the radar more effectively than ever.
Thanks to the deep-dive analytics of ANY.RUN’s interactive sandbox environment, researchers were able to catch many of these schemes mid-operation—offering rare insight into how today’s attacks are being engineered.
What they found wasn’t just malware. It was a refined blend of social manipulation, stealthy execution, and increasingly adaptive code that’s outgrowing traditional detection.
Here’s a breakdown of one standout tactic that shows just how far cyber deception has come:
1. ClickFix: A CAPTCHA With a Hidden Agenda
ClickFix masquerades as a harmless CAPTCHA—until you interact. Instead of a checkbox, users are instructed to press specific keys, unknowingly executing harmful scripts in the background.
ANY.RUN’s sandbox helped map the progression of this attack. Early versions were clunky and detectable—simple strings like “I am not a robot” made them easy to flag with basic filters.
But ClickFix has evolved. It now hides behind more dynamic prompts and evasive code, making it harder to catch without behavioral analysis.
➡️ See it in action: [View the sandbox session]
Bots, Bait, and Unicode: A New Spin on an Old Trick
In one ANY.RUN sandbox session, a seemingly innocent phrase—“I am not a robot”—made its appearance. Harmless? Not quite.
Threat actors have upped their game by hijacking our assumptions about text itself. Enter homoglyphs: characters from foreign alphabets that look nearly identical to standard Latin letters but are technically different under the hood. It’s deception at the Unicode level.
Instead of tweaking the logic of their malware, attackers are now manipulating perception. They embed near-identical characters—like a Greek omicron or a Cyrillic “o”—to outsmart basic string-matching filters that rely on visual similarity, not byte-level inspection.
Take this example spotted in a sandboxed sample:
- “not” becomes “nοt” — with a Greek omicron (
U+03BF) - “robot” turns into “rоbоt” — swapping Latin “o”s for Cyrillic (
U+043E)
To the human eye, it’s identical. But to traditional detection systems? It’s invisible.
🧪 Explore the analysis yourself: [View session]
Invisible Ink for Cybercriminals: The Unicode Cloak
In a deeper dive through ANY.RUN’s sandbox, researchers uncovered a stealth tactic that doesn’t change what you see—but completely scrambles how systems interpret it.
This technique uses invisible Unicode characters like zero-width spaces and right-to-left (RTL) overrides to fragment malicious text without raising visual red flags. The message looks normal to the human eye—but behind the scenes, it’s engineered to confuse scanners, disrupt pattern recognition, and evade basic security filters.
For example:
- Zero-Width Space (
U+200B) inserts a “ghost” character, splitting strings invisibly. - RTL Override (
U+202E) flips text direction, reversing segments like this:
→[U+202E] ABCdisplays as CBA
It’s not just clever—it’s precision camouflage for malware delivery.
🔍 Want to see how this unfolds in real time?
Get hands-on with interactive threat analysis and experience 14 days of ANY.RUN’s premium tools—designed to help you decode even the most deceptive attacks with clarity and speed.
👉 [Start your free 14-day trial]
Unseen Strings, Visible Threats: How ANY.RUN Pulled Back the Curtain
Obfuscation at the string level isn’t just a nuisance—it’s a calculated move by attackers to outmaneuver outdated defenses. But when visual tricks meet behavioral intelligence, the game changes.
ANY.RUN’s real-time sandbox doesn’t rely on signatures or assumptions. It reveals how these tactics behave under pressure—capturing every deceptive twist, hidden character, and evasive maneuver as it happens. It’s not about spotting what looks malicious—it’s about watching what acts malicious.
2. Legacy Domains, Modern Scams: U.S. Users in the Crosshairs
In another April incident, the ClickFix campaign pivoted its focus—this time impersonating trusted tech brands to phish U.S.-based victims.
What made it convincing? Not just fake Microsoft Defender or Cloudflare warnings—but the domain hosting it. This wasn’t some hastily spun-up site. It was a domain originally registered in 2006, impersonating the Indo-American Chamber of Commerce, giving the attack an air of legitimacy.
Behind a U.S. IP address, the site transformed: a full-screen Windows Security Center clone took over, pressuring users to call fake support lines or download “fixes.”
🧪 Dive into the session to see the scam in motion: [View analysis]
When the Screen Lies: Weaponized Pop-Ups and Phony Alerts
Inside ANY.RUN’s interactive sandbox, a convincing replica of the Windows Security Center takes center stage—right before the trap is sprung.
The moment the screen locks, users are bombarded with high-stakes warnings and an urgent push to dial a fake tech support number. This isn’t just social engineering—it’s stagecraft, designed to create panic and bypass logic.
In some variants, the deception runs even deeper. The page flashes a counterfeit Cloudflare error, tricking victims into thinking something is broken on their end—and nudging them to copy and paste attacker-controlled commands in an attempt to “fix” it.
🧪 Curious how it all unfolds without risking your own system?
Explore the full sequence safely inside ANY.RUN’s live sandbox environment: [View the session]
Deception Disguised as Downtime: The Cloudflare Illusion
A fake Cloudflare error message may seem harmless—until it convinces someone to type dangerous commands into their own machine. That’s exactly the psychological play attackers used in this campaign.
But with ANY.RUN’s sandbox, defenders get more than static logs—they get visual evidence. Seeing the full attack flow, step by step, in a controlled environment helps security teams respond faster, smarter, and train more effectively. Especially when the threat is dressed up to look legitimate.
3. WormLocker 2.0: Old Code, New Teeth
Back from the digital graveyard, WormLocker has returned with a serious upgrade. First spotted in 2021, this ransomware strain has resurfaced with enhanced capabilities and a more hostile payload delivery.
The new version is faster, more evasive, and much more aggressive—showing how legacy malware isn’t always left in the past.
🧪 See how WormLocker 2.0 behaves under the microscope: [View analysis session]
WormLocker 2.0 in Action: Old Malware, New Moves
Inside ANY.RUN’s live sandbox, WormLocker 2.0 doesn’t waste time. As soon as it’s triggered, it begins seeding malicious .sys files across common user directories—specifically targeting Desktop and Downloads to maximize impact and visibility.
This isn’t just noise—it’s a calculated move to disrupt fast and intimidate faster. And thanks to real-time behavioral playback, these changes aren’t theoretical—you can watch them unfold second by second inside the sandbox.
🧪 Witness the file drops and ransom demand in real time: [View sandbox session]
WormLocker 2.0 Goes for the Core: Permission Hijack in Motion
After embedding itself, WormLocker 2.0 doesn’t just lurk—it takes control.
Using native Windows utilities like takeown and icacls, the malware forcefully seizes ownership of critical files, rewriting permission structures to lock out the user and protect its payload. Once inside the System32 directory—a high-value target—it rapidly digs in and begins locking the system down from the inside out.
This isn’t a smash-and-grab. It’s a surgical strike on the OS itself.
Command-Line Takeover: WormLocker 2.0 Disarms the System
Armed with takeown and icacls, WormLocker 2.0 doesn’t just encrypt—it confiscates. By forcibly rewriting file ownership and access controls, it turns Windows’ own tools into weapons, stripping users—and defenders—of control.
Once permissions are seized, the malware moves quickly to erase any chance of recovery. It shuts down Task Manager, deletes system-hidden files, kills the Explorer process, and wipes out shell configuration data—ensuring that even after a reboot, the desktop won’t come back.
Encryption with a Twist—and a Voice
WormLocker 2.0 encrypts with AES-256 in CBC mode, using a symmetric key derived from a hardcoded passphrase:LUC QPV BTR
Inputting this sequence is the only way to restore both the system and the files it hijacked.
And just when you think it’s over, the malware delivers its final blow—not as a pop-up, but as a spoken ransom note, launched via a .vbs script. It’s psychological warfare through your speakers.
When Malware Speaks: The VBS Message, Loud and Clear
Inside ANY.RUN’s sandbox, even the most subtle payloads get spotlighted—including the VBS script that delivers WormLocker’s eerie voice ransom note. It’s not just about catching files—it’s about tracing the full narrative of the attack, from the first dropped executable to deep system-level manipulation.
What sets ANY.RUN apart isn’t just visibility—it’s clarity without complexity. Analysts, even at the entry level, can follow the entire kill chain in real time, without wrestling with custom configs or piecing together fragmented logs. It’s threat intelligence, visualized.
4. Tycoon2FA: Precision Phishing with a Regional Focus
Unlike broad, noisy phishing blasts, Tycoon2FA operates with surgical precision. This campaign only reveals its malicious pages to users in select geographies—specifically Argentina, Brazil, and targeted regions across the Middle East.
If you’re outside that zone, you might see nothing suspicious. But from the right IP? You’re greeted with a tailored attack designed to bypass local familiarity and exploit regional trust signals.
Tycoon2FA: When Phishing Knows Where You Live
This isn’t your average phishing campaign. Tycoon2FA operates like a digital sniper—only pulling the trigger if you fit the profile. Using ANY.RUN’s interactive sandbox paired with residential proxies, researchers were able to see the trap unfold from the inside.
It starts with subtle fingerprinting. If your system checks the right boxes—location, timezone, hardware setup—you’re quietly redirected to a convincing phishing page. If not? You’re brushed off to a random decoy site like Tesla or Emirates, never realizing you were profiled and dismissed.
Here’s how the digital sleight of hand works under the hood:
- A hidden image fails to load, triggering a JavaScript
onerrorfunction:onerror="(new Function(atob(this.dataset.digest)))();" - That code silently gathers environmental data—screen resolution, GPU details, browser plugins, time zone, and more.
- Based on this digital fingerprint, the script decides:
✔️ Targeted user? Redirect to the phishing site.
❌ Non-match? Off you go to a harmless destination.
This level of targeting means traditional security tools miss the real action entirely. But ANY.RUN makes it possible to simulate those exact regional fingerprints, helping analysts trigger and investigate attacks that would otherwise remain invisible.
The Bigger Picture: April’s Threat Landscape Was No Fluke
From deceptive CAPTCHAs in ClickFix to the resurrected and upgraded WormLocker, April proved one thing: attackers are adapting faster than many defenses.
These threats don’t sit still. They morph, profile, evade, and exploit—not through brute force, but by blending in.
That’s where ANY.RUN comes in—not just as a sandbox, but as a real-time threat visibility platform. It doesn’t just analyze files; it reveals behavior, adapts to context, and empowers analysts with the full story.
For security teams, this means:
- 🚀 Rapid triage and faster response with dynamic behavioral visibility
- 🧩 No complex configuration—just plug in and analyze
- 📚 Real-world training for junior analysts through visual, traceable attacks
- 🤝 Collaboration-ready workflows with shareable sessions and linked investigations
- 🌍 True geo-awareness with proxy routing and custom locale simulation
Want to See It in Action?
🔓 Unlock 14 Days of Full Access to ANY.RUN
Explore, simulate, and dissect real threats—without risk, with total clarity.
🎓 Join Our Free Live Webinar
Get hands-on insights from security experts as they walk through live malware analysis, step-by-step.
👉 Start Analyzing Smarter Today
