UraLocker is ransomware that we discovered during our routine inspection of samples uploaded to VirusTotal. Upon execution, UraLocker encrypts files and appends its extension (".rdplocked"). For example, it renames "1.jpg" to "1.jpg.rdplocked" and "2.png" to "2.png.rdplocked". UraLocker also chang
Our analysis has shown that it is a deceptive web page promoting a fake airdrop (cryptocurrency giveaway). The scammers behind this site aim to trick users into connecting their wallets, which allows them to steal cryptocurrency. Such sites should be closed if ever encountered to avoid monetary lo
Our analysis indicates that this is a fraudulent website (rabbywallet[.]io) mimicking the official Rabby Wallet site. Its purpose is to deceive users into disclosing personal information, enabling scammers to steal their digital assets. To prevent financial loss, users should immediately close suc
After reading this "We Have Your Search Requests And Webcam Footage" email, we determined that it is a sextortion scam. This spam message claims that Russian hacker affiliates have obtained the recipient's information and recorded a sexually explicit video of them. If the recipient does not meet
Our researchers found this imitator "Xverse" webpage (xversewallets[.]com; potentially other domains) during a routine investigative session. This is a phishing page that impersonates the official website of the Xverse wallet (xverse.app). The scam targets cryptowallet log-in credentials. IM
While investigating suspicious sites, our researchers discovered this fake "AMLBot Crypto Checking" webpage. It is disguised as the official website of the AMLBot platform (amlbot.com). The purpose of this scam is to trick users into exposing their digital wallets to a cryptocurrency drainer.
Our research team found the tracktransit.co[.]in rogue page while investigating suspect websites. After inspecting this webpage, we found that it promotes browser notification spam and redirects users to other (likely unreliable/hazardous) sites. Most visitors to tracktransit.co[.]in and pages ak
Tisfas.co[.]in is a rogue webpage discovered by our researchers during a routine inspection of untrustworthy sites. It is designed to promote browser notification spam and redirect users to different (likely dubious/harmful) websites. The majority of visitors to tisfas.co[.]in and similar pages a
Our analysis of waliekhal[.]com reveals that it can deliver intrusive and deceptive notifications. However, it can only do this if users grant permission. Waliekhal[.]com uses a misleading technique to achieve this. Thus, it is advisable to avoid visiting waliekhal[.]com and never allow similar si
While browsing suspicious sites, our researchers discovered surilour.co[.]in. Upon examination, we learned that it is yet another rogue page that uses a fake CAPTCHA test to trick visitors into permitting its browser notifications. This webpage can also redirect users to different (likely untrustw