KREMLIN Banking Trojan is a multi-stage banking trojan that secretly adds a malicious browser extension to Google Chrome and Microsoft Edge. The extension spies on online banking sessions, records what the victim types, steals cookies and saved passwords, and can even change what the victim sees o
SparroWocky is a backdoor written in C++ and deployed by FamousSparrow, a China-aligned cyberespionage group. It establishes covert, persistent access to infected computers and lets operators run commands, transfer files, capture screenshots, and route network traffic through compromised machines.
ChainScript is a Remote Access Trojan (RAT) written in Node.js that lets attackers secretly control infected Windows computers. It can run commands, handle files, take screenshots, look for cryptocurrency wallets, and install other malware. The RAT was documented in September 2026 by the Adversar
ClosedQuorum is a Windows implant classified as a trojan that combines Remote Access Trojan (RAT) functionality with credential and cryptocurrency theft. What sets it apart is its use of commercial AI language models to autonomously decide which attack action to take next, without requiring a huma
We have examined this email and determined it is a phishing scam. The message falsely claims the email provider is clearing inactive accounts and instructs the recipient to open an HTML file attachment to verify their address. The file displays a fake Zimbra webmail login page intended to steal em
We have inspected this email and determined that it is a phishing scam. The message poses as an official notification from an email service provider, falsely claiming the recipient must verify their account before a set deadline or face deletion. It is designed to steal email login credentials and
We inspected this email and found it to be a phishing scam disguised as a business purchase order inquiry. The message is designed to trick recipients into clicking a link that leads to a fake login page, where their email account credentials are stolen. This email should be ignored and deleted.
We examined this email and concluded it is a phishing scam. The message is disguised as an account maintenance notice, claiming the recipient's email has been flagged as dormant. Its purpose is to trick users into entering their login credentials on a fraudulent page. This email should be ignored.
We have examined this email and determined that it is a phishing scam. The message poses as an official notification from the recipient's email service provider, falsely claiming their account has been restricted. Clicking the link leads to a fake login page designed to steal email credentials. Th
We have examined this email and determined it is a phishing scam. The message is crafted to look like a routine business communication from a contracting firm, attaching what appears to be a bank deposit receipt for a signed contract. Its actual goal is to steal login credentials by directing reci