April wasn’t quiet in the world of cybersecurity. From sneaky fake CAPTCHAs to region-targeted phishing and revamped ransomware, attackers kept busy, refining their tricks and finding new ways to slip past defenses.

Thanks to insights from ANY.RUN researchers, powered by real-time, interactive sandbox analysis, several of these threats were caught in action.

What they uncovered was a mix of clever social engineering, technical trickery, and evolving malware that’s getting harder to spot with the naked eye.

Let’s take a closer look at what made these threats so dangerous and what defenders can learn from them.

1. ClickFix: The CAPTCHA That Clicks Back

A scam known as ClickFix puts a twist on the typical CAPTCHA. Instead of a simple checkbox, users are asked to press a few keys, which secretly triggers malicious code in the background.

Researchers using the ANY.RUN sandbox tracked how this trick evolved:

Early versions used plain text like “I am not a robot”, which made them easy to detect. A basic string match was enough to catch it. You can check this in the following analysis session:

View analysis session

“I am not a robot” displayed inside ANY.RUN sandbox

Then came homoglyphs. These are lookalike letters from other alphabets, like Greek or Cyrillic, to fool string-based detection.

We can see in this analysis session how attackers use the phrase “not a robot”, but the characters are different:

not → nοt (Greek omicron, `U+03BF`)
robot → rоbоt (Cyrillic o, `U+043E`)

Homoglyphs analyzed inside ANY.RUN sandbox

Finally, invisible Unicode characters like zero-width spaces and RTL overrides were added to break up the text without changing how it looks to humans.

See how interactive malware analysis works in real time. Get 14 days of access to ANY.RUN’s advanced features and uncover threats faster, with clarity and confidence -> Try ANY.RUN for 14 Days

During this attack, the user still sees a readable phrase, but part of it is reversed.

Zero-Width Space (U+200B)
Right-to-Left Override (U+202E): [U+202E] ABC → CBA

Unicode characters used in the attack, exposed by ANY.RUN

This kind of string-level obfuscation shows why behavioral analysis tools like ANY.RUN’s sandbox are important.

Instead of relying on static signatures, analysts can see exactly how these evasive techniques unfold in real time and adapt detection methods accordingly.

2. Fake Tech Support Targets U.S. Users

Another ClickFix scam made the rounds in April, this time targeting U.S.-based users with fake Microsoft Defender and Cloudflare pages.

The phishing site was hidden behind a domain registered way back in 2006, posing as the Indo-American Chamber of Commerce.

But when visited from a U.S. IP (as seen in the analysis session), it launched a full-screen pop-up mimicking Windows Security Center.

View analysis session

Pop-up mimicking Windows Security Center displayed inside interactive sandbox

Once the screen locks, victims are hit with alarming warnings and prompted to call a fake support number, opening the door for further exploitation.

In some cases, the page also fakes a Cloudflare error to convince users to run malicious commands. You can see this safely inside ANY.RUN’s sandbox:

Fake CloudFlare error to make the victim run malicious commands

For security teams, this kind of visual replay in a safe, isolated environment helps speed up triage and improves team training, especially when dealing with socially engineered attacks that look legit at first glance.

3. WormLocker 2.0: A Ransomware Relic Gets A Refresh

Originally spotted in 2021, WormLocker is back with a new build, and it’s more aggressive than ever.

View analysis session with WormLocker 2.0

WormLocker 2.0 with its ransom note analyzed inside real-time sandbox

Once executed, WormLocker 2.0 drops malicious .sys files onto the user’s Desktop and Downloads folders. We can see this change displayed inside ANY.RUN sandbox:

Then the malware uses Windows commands like takeown and icacls to hijack system file permissions. It unpacks into the System32 folder and immediately starts locking things down.

Takeown and Icacls commands hijacking system file permissions

To block recovery, it disables Task Manager, deletes hidden files, kills Explorer, and even empties shell settings so the desktop doesn’t return after reboot.

On the encryption side, it uses AES-256 in CBC mode with a key derived from a hardcoded password (LUC QPV BTR). Entering this key unlocks both the system and the encrypted files.

As a final touch, it plays a voice ransom note through a VBS script.

VBS script displayed inside ANY.RUN sandbox

What makes ANY.RUN valuable here is its ability to show the full execution chain from the first dropped file to system-level changes, without needing complex setup. It’s malware behavior made visible and understandable, even for junior analysts.

4. Tycoon2FA: Phishing That Picks Its Targets

Tycoon2FA is a smart, location-aware campaign that only shows its malicious content to users in specific regions, namely Argentina, Brazil, and parts of the Middle East.

Researchers observed how the scam works using the ANY.RUN sandbox with a residential IP.

If the visitor’s system matches certain criteria (like timezone or system details), they’re silently redirected to a phishing page. Everyone else just gets sent to a random site like Tesla or Emirates.

Here’s what happens behind the scenes:

A hidden image fails to load, triggering a script via the onerror event: onerror=”(new Function(atob(this.dataset.digest)))();”
That script collects system data, like screen size, GPU, browser plugins, and time zone.
If your profile matches a target region, the victim is sent to the phishing site. If not, they’re redirected elsewhere.

This is where ANY.RUN’s interactive sandbox really proves its value. Analysts can simulate different regions by setting a locale and using residential proxies, making it possible to trigger and analyze geo-targeted phishing attacks that would otherwise stay hidden.

See What Today’s Threats Are Really Doing

The attacks seen in April, ClickFix scams, region-specific phishing, and the return of WormLocker, are just a glimpse into how fast threat actors are evolving.

These aren’t static files you can catch with a quick scan. They’re dynamic, adaptive, and often invisible until it’s too late.

That’s why you need solutions like ANY.RUN’s interactive sandbox. From spotting subtle tricks to simulating regional fingerprints, these threats and many others can be safely analyzed, understood, and detected in real time, before they make an impact.

For security teams, this means:

Faster incident response with full visibility into malware behavior
No need for complicated setups
Better training and onboarding with visual, real-world examples
Scalable analysis with shareable links and collaborative sessions
The ability to test threats across locales, proxies, and environments

See it for yourself! Get 14 days of access to ANY.RUN and start analyzing threats with clarity and confidence.

Join the Free Live Webinar and Master Faster Threat Detection

Don’t miss this chance to learn from top security experts and see real-world malware analysis in action.

Gain practical insights that will help your team detect threats faster, triage alerts efficiently, and strengthen incident response. Register now and secure your spot!

The post Top Cyber Attacks In April 2025 You Need to Aware appeared first on Cyber Security News.