Phishing attacks have evolved far beyond fake login pages and basic credential theft schemes. Modern campaigns increasingly rely on multi-stage redirects, dynamically injected scripts, hidden iframes, and browser-based content delivery designed to evade traditional security analysis.
As attackers continue to refine these tactics, many Security Operations Center (SOC) teams are finding that conventional URL investigation methods can no longer keep pace. Recognizing this growing challenge, ANY.RUN has introduced a new in-browser phishing analysis capability designed to provide security analysts with complete visibility into how phishing attacks actually unfold inside a victim’s browser.
The new functionality aims to close a critical visibility gap that has long complicated phishing investigations, allowing analysts to observe redirect chains, script execution, DOM modifications, and user-facing content in real time from a single interface.
Key Details
According to findings published by ANY.RUN and shared with Cyber Security News (CSN), traditional phishing analysis workflows often depend heavily on static inspection methods.
While these tools can identify known indicators, they frequently miss the dynamic behaviors that define modern phishing operations.
Security analysts investigating suspicious URLs typically must:
- Run links through multiple analysis platforms
- Trace redirect chains manually
- Capture screenshots at different stages
- Review network traffic separately
- Reconstruct attack behavior from fragmented evidence
This process can consume significant analyst time while still failing to reveal what an actual victim experienced after clicking a malicious link.
ANY.RUN researchers identified this operational challenge as a major blind spot in current phishing investigation practices.
To address the issue, the company developed an in-browser inspection capability that executes suspicious URLs inside a real browser environment and records every action performed during page execution.
Technical Analysis
Unlike traditional URL scanners that primarily inspect web content from the outside, the new approach focuses on capturing browser-native behavior as it occurs.
Full Redirect Chain Visibility
One of the most valuable capabilities is complete redirect chain analysis.
Security teams can view every stage of URL redirection, including:
- Initial landing pages
- Intermediate redirect domains
- Activated iframes
- Final credential harvesting pages
This provides a clear execution path from the original URL to the destination ultimately presented to victims.
Real-Time Script Execution Monitoring
The platform records browser activity as scripts execute, helping analysts identify:
- JavaScript-based phishing logic
- Dynamic content generation
- Credential collection mechanisms
- Obfuscated attack workflows
Because many phishing kits now build content dynamically after page load, these behaviors often remain invisible to traditional scanning tools.
DOM Change Analysis
The HTML DOM Changes feature allows analysts to identify content injected into a page after initial rendering.
This capability is particularly important because modern phishing campaigns frequently use:
- Dynamic HTML injection
- Hidden form creation
- Script-generated login portals
- Delayed payload execution
By highlighting browser-rendered changes, investigators gain visibility into attack elements that static analysis commonly misses.
Threat Intelligence Correlation
The system also automatically extracts:
- Domains
- IP addresses
- URLs
- File hashes
- Additional indicators of compromise (IOCs)
These indicators can then be used to pivot across broader phishing infrastructure and uncover related campaigns.
According to the report, researchers successfully generated a single YARA rule from one phishing page snapshot that identified 14 related samples within the threat intelligence database, demonstrating the value of browser-level artifact collection.
Impact and Risks
The lack of browser-level visibility has become a growing operational challenge for security teams.
Modern phishing attacks increasingly depend on techniques designed specifically to evade traditional detection workflows, including:
- Multi-stage redirect chains
- Dynamic script execution
- Browser fingerprinting
- Delayed content delivery
- Conditional payload loading
- Hidden iframe abuse
Without visibility into these actions, analysts often struggle to confidently determine whether a URL is malicious.
This creates several downstream issues:
- Increased investigation time
- Higher analyst workload
- Escalation bottlenecks
- Delayed incident response
- Reduced detection accuracy
Tier 1 analysts frequently escalate cases due to limited visibility, while senior analysts often must repeat portions of the investigation because critical context is missing from the handoff process.
As phishing campaigns continue growing in sophistication, these inefficiencies can significantly impact an organization’s ability to respond quickly to threats.
Expert Recommendations
Security teams should adapt phishing investigation workflows to account for browser-native attack techniques.
Prioritize Dynamic Analysis
Static inspection alone is no longer sufficient for evaluating modern phishing URLs.
Organizations should incorporate tools capable of observing:
- Browser execution
- Script behavior
- Redirect chains
- DOM manipulation
- User interaction flows
Improve Investigation Context
Analysts should collect comprehensive evidence packages that include:
- Rendered screenshots
- Redirect histories
- HTTP request details
- Browser execution artifacts
- DOM modification records
This improves both triage quality and escalation efficiency.
Leverage Threat Intelligence Enrichment
Collected indicators should be correlated against:
- Threat intelligence platforms
- Internal detection databases
- YARA rule repositories
- Historical phishing investigations
This helps uncover broader infrastructure associated with phishing operations.
Strengthen SOC Workflows
Organizations should standardize phishing investigation procedures and reduce dependency on fragmented toolsets that require manual evidence collection.
Unified analysis environments can significantly improve analyst productivity and response consistency.
Monitor Emerging Browser-Based Threats
Security leaders should recognize that browsers have become a primary attack surface for credential theft, business email compromise (BEC), and identity-focused attacks.
Investing in browser-centric visibility is becoming increasingly important for modern threat detection programs.
Industry Context
The introduction of browser-level inspection reflects a broader shift occurring across the cybersecurity industry.
For years, URL analysis focused largely on reputation checks, static content reviews, and network-based indicators. However, threat actors have steadily moved toward dynamic delivery mechanisms that only reveal their malicious intent during execution.
This mirrors broader trends across cybercrime and phishing ecosystems, including:
- Phishing-as-a-Service (PhaaS) platforms
- Adversary-in-the-Middle (AiTM) phishing kits
- MFA bypass campaigns
- Dynamic credential harvesting pages
- Browser-based malware delivery
As attackers continue to weaponize browser functionality, security vendors are increasingly developing tools that replicate the victim experience rather than simply analyzing URLs from a distance.
The growing emphasis on browser-native telemetry highlights how phishing investigations are evolving from simple URL reviews into full behavioral analysis exercises.
Conclusion
ANY.RUN’s new in-browser data inspection capability addresses a longstanding challenge facing modern SOC teams: understanding exactly what happens after a user clicks a suspicious link.
By providing complete visibility into redirect chains, script execution, DOM modifications, iframe activity, and user-facing content, the platform enables analysts to investigate phishing campaigns with far greater speed and accuracy.
As phishing threats become increasingly dynamic and evasive, browser-level visibility is rapidly shifting from a useful enhancement to a fundamental requirement for effective threat detection and incident response.
FAQ SECTION
What is in-browser phishing analysis?
In-browser phishing analysis involves executing suspicious URLs inside a real browser environment and monitoring all activity, including redirects, scripts, DOM changes, and user-facing content.
Why do traditional phishing analysis tools miss modern attacks?
Many traditional tools rely on static analysis and cannot observe dynamic browser behaviors such as JavaScript execution, iframe activity, or delayed content injection.
What are phishing redirect chains?
Redirect chains occur when users are routed through multiple URLs before reaching a final phishing page. Attackers use them to evade detection and obscure malicious infrastructure.
How does browser-level visibility help SOC teams?
It provides analysts with complete evidence of how a phishing attack operates, reducing investigation time and improving confidence in detection decisions.
What indicators can analysts collect from browser-level analysis?
Analysts can gather domains, IP addresses, URLs, file hashes, screenshots, HTTP requests, DOM artifacts, and other indicators useful for threat hunting and detection engineering.
