Our discovery of Smile occurred while examining malware samples uploaded to VirusTotal. Upon analysis, we concluded that Smile is ransomware that encrypts files to prevent victims from accessing them. This malware also changes the desktop wallpaper, drops a ransom note ("SM$LE-read-it.txt"), and a
We have examined smartadsboost[.]top and found that it displays misleading content to get permission to show notifications. If users agree to receive notifications from smartadsboost[.]top, they can be bombarded with fake warnings and other messages designed to open other untrustworthy websites. T
Our analysis of pherciterzorte[.]com has uncovered that it uses a deceptive technique to trick visitors into permitting it to show notifications. Once allowed, pherciterzorte[.]com displays notifications containing fake warnings and other misleading messages. Users should avoid visiting pherciterz
While browsing dubious websites, our researchers discovered the optimizedevice.co[.]in rogue page. After investigating this webpage, we learned that it promotes spam browser notifications and redirects users to other (likely dubious/hazardous) sites. The majority of visitors to optimizedevice.co[.
Our researchers found the Popup Blocker Max browser extension while investigating dubious websites. It is promoted as a tool for blocking pop-ups and other types of ads (ad blocker). Upon inspection, we determined that this extension operates as adware – i.e., it displays advertisements. A
After reading this "Google Anniversary Award" email, we determined that it is a phishing scam. This spam message claims that the recipient has been selected as a winner in an award organized by Google. It must be emphasized that this email is fake and not associated with the actual Google LLC. Th
Trendthreadlink[.]com is a rogue page discovered by our researchers during a routine investigative session. This webpage promotes deceptive content and browser notification spam. It can redirect users to different (likely untrustworthy/malicious) sites as well. Most visitors to trendthreadlink[.]
After inspecting this "Online Webmail Deactivation" email, we determined that it is spam. This is a phishing email targeting log-in credentials by claiming that the account has been blocked and will be deactivated unless the appropriate actions are taken. The spam email with the subject "N
We inspected osx-defender[.]pro and found that it is crafted to trick visitors into agreeing to receive its notifications. The site uses clickbait to obtain permission to deliver notifications. Usually, if allowed, sites like osx-defender[.]pro send fake warnings and other messages to lure users i
We have examined the email and concluded that it is a fake letter regarding a Webmail account password validation. We classified it as a phishing email because it contains links leading to a deceptive website designed to steal login credentials from unsuspecting recipients. This email should be ig