Our researchers discovered OperativeNavigation while inspecting new file submissions to the VirusTotal platform. After examining this application, we determine that it is advertising-supported software (adware). Pvadinimas is part of the AdLoad malware family. The purpose of adware is to
After reviewing this "Big Lotto" email, we determined that it is spam. This phishing message claims that the recipient has won the six million USD grand prize in a lottery. The purpose of this spam campaign is to collect victims' personally identifiable and finance-related information. The
Octalyn is a stealer written in the C++ programming language. This malware is designed to steal vulnerable information, including various log-in credentials and cryptocurrency wallets. At the time of writing, Octalyn's developer(s) is promoting it on the GitHub platform. Octalyn is compati
NodeSnake is a Remote Access Trojan (RAT) built to provide persistent access, conduct system surveillance, and execute remote commands. It uses various evasion techniques, communicates with Command-and-Control (C2) servers over HTTP/HTTPS, and delivers secondary payloads. At least two versions of
Our research team discovered syncchainsolutions.co[.]in while browsing suspect websites. This rogue page is designed to promote browser notification spam and generate redirects to different (likely unreliable/harmful) sites. Syncchainsolutions.co[.]in and analogous webpages are primarily accessed
Our researchers discovered the mbs-adguard[.]pro rogue page while investigating dubious websites. After examining this webpage, we determined that it promotes browser notification spam and redirects users to other (likely unreliable/dangerous) sites. The majority of visitors to mbs-adguard[.]pro
Our discovery of Smile occurred while examining malware samples uploaded to VirusTotal. Upon analysis, we concluded that Smile is ransomware that encrypts files to prevent victims from accessing them. This malware also changes the desktop wallpaper, drops a ransom note ("SM$LE-read-it.txt"), and a
We have examined smartadsboost[.]top and found that it displays misleading content to get permission to show notifications. If users agree to receive notifications from smartadsboost[.]top, they can be bombarded with fake warnings and other messages designed to open other untrustworthy websites. T
Our analysis of pherciterzorte[.]com has uncovered that it uses a deceptive technique to trick visitors into permitting it to show notifications. Once allowed, pherciterzorte[.]com displays notifications containing fake warnings and other misleading messages. Users should avoid visiting pherciterz
While browsing dubious websites, our researchers discovered the optimizedevice.co[.]in rogue page. After investigating this webpage, we learned that it promotes spam browser notifications and redirects users to other (likely dubious/hazardous) sites. The majority of visitors to optimizedevice.co[.