16 posts · Last used 9d
🪰 We taught a fly to analyze phishing in #ANYRUN Sandbox. No OCR, no LLM, no DOM hints, and no ability to read.
Thanks to sandbox interactivity, the fly can move through the attack chain on its own and observe the full phishing flow: follow links, resolve CAPTCHAs, go through redirects, and fill forms with an email and password.
See how the fly moves through an AiTM phishing flow: 🪰 https://app.any.run/tasks/92c4e053-5abf-428a-8587-bc8abd43c7fd/?utm_source=mastodon&utm_medium=post&utm_campaign=fly_analyzed_phishing&utm_term=210926&utm_content=linktoservice 🪰 https://app.any.run/tasks/f32ec968-3f2d-49f0-8654-6581370740f1/?utm_source=mastodon&utm_medium=post&utm_campaign=fly_analyzed_phishing&utm_term=210926&utm_content=linktoservice Device Code Flow: 🪰 https://app.any.run/tasks/3efc3564-7a8b-4475-8114-c86fde18ad48/?utm_source=mastodon&utm_medium=post&utm_campaign=fly_analyzed_phishing&utm_term=210926&utm_content=linktoservice
🧠 What’s inside:
𝗕𝗿𝗮𝗶𝗻. Fruit fly hemibrain mapped to FlyWire for 3D visualization.
𝗙𝗹𝗶𝗴𝗵𝘁. There is inertia, sharp saccades instead of a smooth path, and braking based on how fast the image moves.
𝗩𝗶𝘀𝗶𝗼𝗻, 𝘀𝗺𝗲𝗹𝗹, 𝗮𝗻𝗱 𝘁𝗮𝘀𝘁𝗲. The fly cannot read. There is only contrast, movement, color, and shape. A button, link, and checkbox are different visual patterns converted into sensory signals.
𝗟𝗲𝗴𝘀. Landing on the right area counts as a click. If the fly finds an empty field, it “secretes acid”: select all → paste email.
𝗗𝗼𝗽𝗮𝗺𝗶𝗻𝗲, 𝗺𝗼𝘁𝗶𝘃𝗮𝘁𝗶𝗼𝗻, 𝗮𝗻𝗱 𝗮𝘃𝗲𝗿𝘀𝗶𝗼𝗻. When fed, it mostly flies around and looks at the page instead of clicking blindly. When hungry, it is more active and gets frustrated faster when it finds nothing. A successful click gives a reward signal and reduces frustration. A dead click increases avoidance of that area. When the search reaches a dead end, frustration makes the fly scroll down.
𝗠𝗲𝗺𝗼𝗿𝘆. It remembers the screen map and does not return to places where nothing happened— inhibition of return.
❗️ The fly is not smarter or more useful than an ML model trained for the task. This is not a phishing detection solution and not an attempt to replace one.
Made for fun, research curiosity, and the community 🤗
