GachiLoader is a malicious program written in Node.js. This malware is classed as a loader – it is designed to download/install additional malicious programs onto compromised systems. GachiLoader has been distributed through a campaign leveraging compromised YouTube accounts. In this campaign, the
Our researchers found giumbletepe.co[.]in while browsing untrustworthy websites. This rogue page promotes browser notification spam and generates redirects to various (likely unreliable/dangerous) sites. Most visitors to giumbletepe.co[.]in and analogous webpages enter them through redirects produ
Search.ansiblealgorithm.com is a website that our research team discovered while analyzing the AI Output Algo Tool. This browser extension is advertised as a tool that provides AI (Artificial Intelligence) summaries in multiple languages for search queries/results. AI Output Algo Tool is a browse
Our researchers discovered this fake "Brevis Snapshot" page (brevis-snapshot[.]xyz; other domains are possible) during a routine investigation. It is in no way associated with the real Brevis Network. The purpose of this scam is to trick users into connecting their digital wallets to a cryptocurre
ResidentBat is an Android spyware that is installed through physical access to the victim’s device. Once infiltrated, it abuses broad application permissions and enables an Accessibility Service, giving it deep and persistent control over the phone. If detected, ResidentBat should be removed immed
After reviewing this "DHL Express - Incoming Package Arrival Notification" email, we determined that it is fake. This phishing message is presented as an alert concerning an incoming package. The goal is to deceive recipients into revealing their email account log-in credentials. It must be emphas
"cPanel Account Suspension" is a spam email claiming that suspicious activity has been detected on the recipient's account. It was supposedly suspended as a security measure. The goal of this fake message is to trick victims into visiting a phishing website targeting email account log-in credentia
Our review has revealed that this website (vro14roz.pages[.]dev) copies the appearance of the original Rarible website (rarible.com). The fraudulent version is designed to deceive visitors into performing steps that can result in significant financial loss. Thus, it is strongly advisable not to tr
We have inspected torathing[.]com and determined that it is an untrustworthy website that uses clickbait to trick visitors into agreeing to receive notifications. If permitted, torathing[.]com can display bogus alerts and other misleading messages to trick users into visiting dubious web pages.
While inspecting malware samples submitted to VirusTotal, our team discovered ransomware known as VantaBlack. The purpose of this malware is to encrypt files and demand ransom for their release. It provides two identical ransom notes ("!HOW TO RESTORE!.txt" and "!README!.txt") containing contact a