Joe Reverser 1.0.0 Silver Wolf
Joe Security's Blog
Today, we are proud to announce the official release of Joe Reverser 1.0.0 “Silver Wolf”, marking the transition from Beta to a stable production version.
Silver Wolf introduces powerful new and enhanced capabilities designed for deep analysis of malware and phishing attacks. In this blog post, we showcase some of the key features that make this release a major milestone.
For readers who are new to Joe Reverser, we recommend starting with our introductory blog post here:
Introducing Joe Reverser, the Agentic Automated Malware & Phishing Analyst
To get started, visit www.joesandbox.com create an account, and select Joe Reverser.
Web Agent
We have upgraded the web browser capability to a fully featured web agent with the following enhancements:
-
Full Chromium browser (patched), running in non-headless mode
Automated interaction (clicking, typing, drag-and-drop, form submission)
-
Clipboard control
-
Download management
-
Screenshot capture
-
Video recording
These capabilities enable the agent to autonomously navigate phishing campaigns and drive-by download pages. It can handle CAPTCHA challenges and avoids detection by common bot-detection mechanisms, including solutions such as Cloudflare Turnstile.
Below is a video demonstrating navigation of a ClickFix attack:
Full analysis link here.
Below is another example showing interaction with a phishing page:
These improvements significantly enhance the realism and depth of web-based threat analysis. By operating a full, non-headless Chromium browser, the agent behaves much closer to a real user session. Malicious websites that previously restricted or altered content when detecting automation can now be analyzed under authentic conditions.
The ability to automate user interactions allows the agent to progress through complex, multi-stage attack chains. Credential harvesting flows, dynamic phishing kits, and staged malware delivery mechanisms can be fully executed and observed without manual intervention. Integrated CAPTCHA handling further ensures that protective barriers designed to block automated systems no longer prevent visibility into the complete attack lifecycle.
At the same time, built-in screenshot and video recording capabilities provide clear, reproducible documentation of each step. This improves reporting quality, facilitates internal knowledge sharing, and strengthens customer-facing deliverables.
Overall, the upgraded web agent increases analytical coverage, improves evasion resilience, and enables safer, more efficient investigation of modern web-based threats.
Improved Code Sandbox
With Joe Reverser 1.0.0, we completely redesigned the Code Sandbox used by the agent to generate deobfuscation and unpacking scripts.
The new sandbox architecture delivers significantly improved performance and now provides direct Bash access. This enables the agent to iteratively modify and extend existing Python scripts instead of rewriting them from scratch for every change.
As a result, script development is faster, more flexible, and better suited for complex, multi-step deobfuscation and unpacking workflows.
.png)
Skill only Mode
With the latest Joe Reverser update, we introduced a new operating mode called “Skill Only Mode.”
This mode allows analysts to define requirements more precisely and directly guide the agent toward specific objectives. Instead of relying on predefined workflows, analysts can focus on invoking targeted capabilities tailored to the task at hand.
Skill Only Mode operates with a lighter execution harness, reducing constraints and overhead. As a result, it delivers improved efficiency and faster task completion compared to the traditional workflow-based mode, while offering greater flexibility and control.
Chat Report
In addition to the Analysis Report, Joe Reverser now also generates a dedicated Chat Report. This report contains the complete conversation history between the analyst and the agent, providing full transparency into every prompt, response, decision, and intermediate step.
The Chat Report makes the entire analysis process traceable and reproducible. Analysts can review how conclusions were reached, revisit specific instructions or generated code, and use the documented interaction for knowledge sharing, auditing, or customer communication purposes.
Office Document Analysis
We have added analysis support for Microsoft Office file formats, including DOC/DOCX, XLS/XLSX, and PPT/PPTX. Joe Reverser can statically parse these formats and perform structured visual analysis of their contents.
This enhancement is particularly important because a significant portion of modern phishing campaigns begins with malicious Office documents. Word files are frequently used as initial infection vectors, often embedding QR codes that redirect victims to credential-harvesting pages or malware delivery sites. Attackers rely on these documents to bypass email filtering and shift the malicious interaction to a secondary channel, such as a mobile device.
Full Analysis link here.
Final Words
Joe Reverser 1.0.0 “Silver Wolf” represents a major step forward in automated malware and phishing analysis. With a more realistic web agent, a redesigned code sandbox, flexible Skill Only Mode, full chat traceability, and extended Office document support, the platform is now ready for stable production use.
This release strengthens analytical depth, improves efficiency, and increases transparency across the entire investigation lifecycle. From initial phishing lure to final payload execution, analysts gain clearer visibility and stronger control than ever before.
Silver Wolf is built to handle modern, evasive threat campaigns while keeping the workflow streamlined and reproducible.
We invite you to explore the new capabilities and experience the next generation of agentic threat analysis. Register for a free Joe Sandbox Cloud Basic account and start using Joe Reverser today.