Detecting malicious AnonymousFox email messages sent from compromised sites · Blog · Sublime Security

AnonymousFox is an active cyber-criminal group (since 2019) that exploits plugin vulnerabilities across CMS platforms (WordPress, Drupal, Joomla, OpenCart) to gain full control of sites, install PHP mailers, host malware, and send phishing campaigns; the report details observed TTPs, concrete header-based IOCs (e.g., 'anonymousfox'/'smtpfox' in X-Authenticated-Sender/X-Sender or sender address), presents an MQL detection rule, and recommends detection and prevention measures.