PicMo is ransomware our research team discovered during a routine inspection of new malware samples submitted to VirusTotal. It encrypts files on compromised systems, replaces original filenames with randomly generated strings, and appends a shared random extension. The ransom note also threatens
Golden Woolf is ransomware our researchers discovered while inspecting new malware samples submitted to VirusTotal. It encrypts files on the victim's computer, appends the .wolf extension to filenames, and opens a pop-up window with ransom demands. On our test machine, Golden Woolf encrypted file
We have inspected this email and determined it is malspam - a fraudulent message crafted to deliver malware. It poses as a shipping notice from FedEx, claiming that a parcel's customs clearance requires further information. The email has no connection to FedEx whatsoever and should be deleted imme
After inspecting this email, we determined that it is malspam. The message pretends to be a shipment notification from DHL Express, urging recipients to open an attached file that supposedly contains shipping documents. In reality, the attachment is designed to deliver malware, so the email should
After inspecting this email, we determined it is a phishing scam. The message is disguised as a notification from DocuSign, a legitimate electronic signature service, claiming the recipient has a document pending review and signature. Clicking the link inside leads to a fake email login page desig
We have examined this email and concluded it is a phishing scam. It poses as an automated notice from cPanel Webmail support, falsely claiming the recipient must update their email credentials or lose mailbox access. This email should be ignored. The email claims the recipient's mailbox wi
Rokarolla is a banking trojan targeting Android devices. It abuses Accessibility Services to take near-complete control of infected phones and steal banking and cryptocurrency credentials. Rokarolla was first analyzed by Zimperium researchers Vishnu Pratapagiri and Fernando Ortega. In the
CRIMSON is ransomware discovered by our researchers during a routine inspection of new submissions to the VirusTotal website. It encrypts victims' files and demands payment in exchange for decryption. After completing encryption, the ransomware presents its ransom demands in a full-screen message.
macOS.Gaslight Backdoor is a backdoor written in the Rust programming language that also carries information-stealing functionality. It targets Mac operating systems and gives attackers the ability to run commands remotely while quietly collecting data from the infected device. According to rese
We have examined this email and determined that it is a phishing scam. The message poses as an urgent notice from a bank official claiming a payment was sent to the wrong account and requesting the recipient to open an attached PDF. The link inside the PDF leads to a fraudulent website designed to