During our inspection of malware samples submitted to VirusTotal, we discovered ransomware called ClearWater. Once executed, ClearWater encrypts victim's files and appends its extension (".clear"). For instance, it renames "1.jpg" to "1.jpg.clear" and "2.png" to "2.png.clear". It also creates a te
We have inspected the site (solbullishdegen[.]com) and determined that it is designed to trick recipients into compromising their cryptocurrency wallets. It copies the design of the original BULLISH website (bullishdegen.com) to appear trustworthy. This website should be avoided to prevent financi
Our analysis shows that this is a scam email that is designed to appear urgent and important to trick recipients into opening the included link. The scammers behind this fraudulent email aim to extract personal information. Falling for this scam can lead to account hijacking and further issues.
Our analysis of ovitchon[.]com shows that it uses a misleading method to persuade users to allow browser notifications. After permission is granted, these notifications may be abused to deliver unwanted and annoying content. For this reason, users should never agree to get notifications from pages
AuraStealer is a malware-as-a-service (MaaS) infostealer written in C++. It is offered through tiered subscriptions: Basic at $295/month, Advanced at $585/month, and a Team plan for collaborative use. The malware targets various applications, including web browsers and their extensions. If detecte
VVS is a Python‑based information‑stealing malware. It primarily targets Discord data and information saved in web browsers. The VVS stealer utilizes PyArmor to obfuscate its code, making analysis more difficult and enabling it to evade detection by security tools. If VVS is noticed on a device, i
We have reviewed cikadron.co[.]in and determined that it uses a deceptive tactic to get users to enable browser notifications. Once accepted, these notifications can be used to promote potentially malicious content. Thus, users are strongly advised to avoid granting notification permissions to cik
Our team has inspected the website (claim-lobster[.]xyz) and determined that it is a cryptocurrency scam. The site offers visitors free tokens (to participate in a crypto airdrop) as a lure. However, victims would never receive any tokens and may have their wallets emptied. Thus, this page should
We have analysed the website (claim-fish[.]xyz) and discovered that it promotes a fraudulent airdrop. The site imitates the original rainbowfish platform (rainbowfish.vip) to trick visitors into interacting with it. The goal is to steal cryptocurrency from unsuspecting individuals. IMPORTANT
Our research shows that timesearches.com is a fake search engine. It is distributed through the Time Search browser extension, which is a browser hijacker. Typically, browser hijacking involves changing browser settings. Using timesearches.com can lead to redirects to potentially harmful pages, so