LabubaRAT is a Remote Access Trojan (RAT) written in the Rust programming language that disguises itself as NVIDIA software. The analyzed sample was named nvidia-sysruntime.exe and carried fake NVIDIA version information and branding to make it appear like a legitimate system tool. According to r
Our research team found the primagrowthforge[.]com rogue page while investigating suspicious websites. After examining this webpage, we determined that it promotes browser notification spam and redirects visitors to other (likely unreliable or harmful) sites. Primagrowthforge[.]com display
Our researchers discovered forgegrowthrise[.]com while investigating dubious websites. After examining this rogue page, we determined that it promotes browser notification spam and may redirect visitors to other unreliable or harmful sites. Most visitors arrive through redirects generated by rogue
Our research team found the ascendgrowthforge[.]com rogue page while investigating suspicious websites. After inspecting this webpage, we learned that it promotes browser notification spam and redirects visitors to other (likely unreliable or harmful) sites. Ascendgrowthforge[.]com present
While inspecting dubious websites, our research team came across the worthilininence[.]com rogue page. After examining it, we determined that its primary purpose is to trick visitors into enabling browser notifications. Once permission is granted, the site delivers misleading security alerts and o
We have examined this email and concluded that it is a scam. The message impersonates the United States Department of Commerce and falsely claims the recipient has been nominated for the Trump Gold Card selection program. The goal is to trick unsuspecting recipients into paying upfront fees and do
We inspected this email and confirmed it is malspam. It impersonates a Citrix ShareFile notification about a settlement eDocument, but its real purpose is to trick recipients into installing a trojanized ScreenConnect installer. This email should be ignored and deleted without clicking any links.
We have inspected the website fomoo[.]family and found that it copies the design of the legitimate Fomo trading platform (fomo.family) almost exactly. The page is built to trick visitors into connecting their cryptocurrency wallets, which can result in the theft of their digital assets. IMPO
HYFLOCK is ransomware that we discovered while examining malware samples submitted to the VirusTotal platform. Like other ransomware, it encrypts files on the victim's computer, making them inaccessible, and demands payment in exchange for decryption. On our test machine, HYFLOCK appended the ".l
We have inspected this email and determined it is a phishing scam. Disguised as an official mailbox migration alert, it falsely claims the recipient's email account transfer has failed and requires their immediate attention. Its purpose is to direct users to a fraudulent login page where their ema