NoBackups is ransomware our team discovered while examining malware samples uploaded to VirusTotal. Our analysis shows that NoBackups encrypts files, appends the victim's ID and ".nobackups" extension to them, and generates a ransom note ("README.TXT"). An example of how NoBackups changes the nam
Our analysis of galeritintite[.]com has revealed that it is a deceptive website that wants to show notifications and uses clickbait to obtain permission to do so. If allowed, galeritintite[.]com can send fake warnings and other misleading notifications to promote potentially malicious sites.
We have inspected the website (nuralabs.pages[.]dev) and found that it mimics the original Nura Labs page (nura.gg). The fake site includes a malicious tool allowing scammers to steal crypto. Thus, interacting with it can lead to significant financial loss. Users should avoid the fake NuraLabs sit
While investigating suspicious websites, our research team found the gesmart[.]site rogue webpage. Upon examination, we learned that it promotes browser notification spam and produces redirects to other (likely unreliable/hazardous) sites. Most visitors to gesmart[.]site and similar pages access t
RMC is a stealer-type malware based on the Electron framework. The potential origin of this malicious program is the sale of Leet stealer's source code in April 2025, as there is some evidence that the code was used when building RMC. This malware, as well as Leet and Sniffer stealers, have been s
Leet is an Electron-based stealer that emerged in late autumn of 2024. This data-stealing program was initially offered as MaaS (Malware-as-a-Service) before its source code (alongside that of the Hexon stealer) was put on the market in the spring of 2025. Since then, several variants of this malw
Our analysis of the website (presale-rudi[.]xyz) has shown that it is a scam where fraudsters promote a fraudulent cryptocurrency project. The scammers behind it aim to drain crypto wallets. Thus, victims of this scam can experience significant monetary loss. This and similar scams should be avoid
While investigating suspicious websites, our research team discovered this fake "Snoonaut ($SNOOT)" airdrop. The webpage states that eligible users can claim SNOOT tokens – thus, it lures them into exposing their digital wallets to a cryptocurrency drainer. It must be stressed that this scam is no
Our analysis has revealed that claims-spheron[.]network imitates the official Spheron web page to trick visitors into taking actions that can lead to the theft of their cryptocurrency. Like most similar scams, the fake Spheron site offers users rewards as a lure. This and similar deceptive pages s
While browsing suspicious sites, our researchers found the getnindscompany[.]com rogue webpage. It operates by promoting browser notification spam and generating redirects to different (likely untrustworthy/hazardous) websites. Getnindscompany[.]com and analogous pages are most likely accessed thr