Dark Caracal malware refers to the multi-component toolkit deployed by the Dark Caracal advanced persistent threat (APT) group. According to research published by Arctic Wolf, the group has been active across Latin America, with a confirmed intrusion at a communications organization in Venezuela i
We have examined this email and determined that it is a phishing scam. The message falsely claims that the recipient's Spotify Premium subscription has been cancelled due to a payment problem and urges them to update their billing details. It should be ignored to avoid having account credentials s
We have examined this email and determined that it is a phishing scam. The message is disguised as a business communication from a real company, urging the recipient to review documents uploaded to SharePoint. The link it contains leads to a fraudulent page designed to steal login credentials. Thi
We have inspected this email and concluded that it is a phishing scam. The message impersonates Bank of America, falsely claiming that the recipient's online banking services have been restricted. Its purpose is to lure victims into entering their banking credentials on a fraudulent website, and i
We have examined this email and concluded that it is a scam. It poses as a desperate plea from a young woman claiming to have inherited millions in gold following a family tragedy, and it asks the recipient to act as a secret business partner. The goal is to draw victims into an ongoing exchange w
Monoxide RAT is a Remote Access Trojan (RAT) designed to give attackers full control over infected Windows computers. It operates silently in the background while providing the operator with a broad range of surveillance and system-control capabilities. Threats of this kind are sold or rented to
While investigating dubious websites, our researchers came across rabbysend[.]site, a page promoting a fake airdrop using the Rabby Wallet brand. The site is designed to deceive visitors into connecting their cryptocurrency wallets, after which a drainer tool empties the victim's funds without the
TRIPAUL3 is a modular Remote Access Trojan (RAT) for 64-bit Windows, written in C++, that gives attackers extensive remote control over infected machines. The malware stores its configuration and six encrypted plugins inside the executable's overlay - a region of the file that sits beyond the sta
Upon examining xrpl-xaman[.]com, our researchers found it masquerades as an official Xaman wallet airdrop portal. The site claims to distribute 250,000,000 XAM tokens to early users, but it is a fraudulent page designed to drain cryptocurrency from anyone who connects their wallet. IMPORTANT
We have examined this email and concluded it is a phishing scam. It is disguised as an automated alert from the recipient's email administrator, falsely claiming that several incoming messages could not be delivered. The aim is to lure recipients into entering their email login credentials on a fa