5 Sandbox Tools for Phishing Analysis in 2026

Analysts have various options for investigating phishing attacks , and utilizing a malware analysis sandbox can be effective.

Combining static and dynamic analysis, these tools are adept at handling elusive phishing threats. Here are five key sandbox solutions for enhancing investigative processes.

In complex phishing attacks, sandboxes offer interactivity. ANY.RUN provides control over the virtual machine, allowing analysts to manually engage with phishing attacks by:

Clicking on links Copying/pasting information within the VM Downloading attachments Solving CAPTCHAs

Analysts can also open password-protected archives commonly sent as attachments in phishing emails to safely access their contents. This feature allows observation of malware behavior in response to analyst actions, providing valuable insights into attacker tactics.

ANY.RUN allows interaction with the VM similar to an ordinary PC

This sandbox session demonstrates a phishing attack using a chain of redirects to evade security detection, starting with a TikTok link redirecting to a Google AMP URL, culminating in a phishing page hosted by Cloudflare IPFS.

ANY.RUN's interactive analysis enables tracking the entire attack chain, including submitting fake credentials. Data entered is shown to be sent to a malicious domain via an HTTP POST request.

RSPAMD, a spam filtering system, evaluates emails' spam levels by scoring each email. The integration of RSPAMD in the ANY.RUN sandbox allows assessment of potential phishing threats and examination of email components, including headers, content, and attachments, for a comprehensive risk understanding.

This session shows a high RSPAMD score indicating a likely spam category. The module highlights base64-encoded text parts, a short HTML part with an image link, excess whitespace in the "From" header display name, and an unknown client hostname.

Suricata, an intrusion-detection system, identifies phishing and malware attacks. ANY.RUN's Suricata engine matches phishing-related activity to existing signatures, showing triggered rules to the user. Analysts can view rule content for clarity and copy it to enhance security systems. The engine is regularly updated with rules for new phishing attacks.

A Suricata rule signaling phishing activity

This sandbox session analyzes a phishing attack where users are asked to enter credentials on a fake form. A Suricata rule provides details about the fake authentication page, source, destination IPs/ports, and protocol information.

The MITRE ATT&CK Matrix is a standard for analyzing cyber threat Tactics, Techniques, and Procedures (TTPs). The ANY.RUN sandbox maps TTPs found in phishing attacks to this framework, aiding analysts in understanding attacker methods and motivations, and promoting collaboration and knowledge sharing.

The MITRE ATT&CK matrix reveals TTPs used by malware

In this sandbox session , a .zip archive phishing attachment was analyzed, detecting the presence of Remcos, a remote access trojan (RAT), highlighting the malware's activities. The MITRE ATT&CK matrix provides insights into the specific TTPs utilized during execution.

The “phishing” and “spam” tags enable analysts to identify and categorize potential threats efficiently, crucial for handling large email volumes and reducing successful attack risks.

Tags help analysts quickly determine if the sample poses a threat

In this analysis session, the sandbox results display an .eml file analysis with “spam” and “phishing” tags, indicating "Malicious activity." This information aids users in deciding further actions concerning the email.

Additionally, ANY.RUN provides a Threat Intelligence Lookup portal for investigating phishing attacks and other threats. Analysts can perform advanced searches using over 30 indicators like IPs and TTPs, revealing more threat context, related indicators, and sandbox analysis sessions.

The portal leverages the ANY.RUN sandbox’s public database, receiving thousands of daily malware and phishing sample uploads globally, offering insights into the current threat landscape.

The results of a combined query submitted to TI Lookup

For demonstration, a query gathers information on recent phishing attacks aimed at obtaining user passwords. The query consists of:

Task type and threat level : Searching for all URLs analyzed in the sandbox in the past 14 days flagged as malicious. URL element : Focusing on URLs containing the “@” symbol, used in phishing links with pre-filled email addresses.

This query uncovers contextual data from analyses matching the criteria, including associated IPs, domains, and analysis sessions, offering insights into recent phishing threats.

The ANY.RUN sandbox facilitates phishing and malware analysis, delivering results in under 40 seconds.

Explore how ANY.RUN’s features, such as the private team space, all Windows VMs, and advanced analysis settings, can enhance your work.

Schedule a personal demo of the sandbox for your team!

Based on reporting by Cyber Security News.