HYFLOCK is ransomware that we discovered while examining malware samples submitted to the VirusTotal platform. Like other ransomware, it encrypts files on the victim's computer, making them inaccessible, and demands payment in exchange for decryption. On our test machine, HYFLOCK appended the ".l
We have inspected this email and determined it is a phishing scam. Disguised as an official mailbox migration alert, it falsely claims the recipient's email account transfer has failed and requires their immediate attention. Its purpose is to direct users to a fraudulent login page where their ema
We have examined this email and concluded it is a scam. The message falsely claims the recipient has earned $7,146,325.16 in cryptocurrency through a fabricated "Digital Money Market Funding System" and instructs them to contact scammers via Signal messenger to claim the funds. This is an advance-
After inspecting this email, we determined that it is malspam. The message pretends to be a business inquiry from a travel and tour company representative planning a corporate dinner and requesting hotel bookings. In reality, its purpose is to deliver malware onto the recipient's device, so it sho
While examining suspicious websites, our researchers came across claimext[.]com, a page promoting a fake $EXT token allocation claim. The site is designed to deceive visitors into connecting their cryptocurrency wallets, which activates a drainer that transfers their funds directly to scammers.
While investigating suspicious websites, our researchers encountered voting-flap[.]com, a page fraudulently impersonating the Flap platform (flap.sh). The site invites visitors to participate in a fake voting rewards program and prompts them to connect their cryptocurrency wallets. It is, in reali
RedWing is a commercial spyware platform offered through a subscription model, targeting Android users. It is capable of intercepting SMS messages, harvesting financial credentials, recording audio and video, and granting attackers full remote control over infected devices. According to research p
MODBEACON is a Remote Access Trojan (RAT) that lets a remote operator secretly access an infected Windows computer, run commands, and load extra plugins while staying hidden in memory. According to research published by Qianxin Threat Intelligence Center, MODBEACON is used in a campaign the resea
SCMBANKER Trojan is a banking trojan built in PowerShell and aimed at users of Mexican financial institutions. According to research by Elastic Security Labs, it is part of an active, operator-assisted fraud campaign tracked as REF6045. The malware is delivered through ClickFix fake CAPTCHA pages
While examining suspicious websites, our team inspected paxolaunch[.]live and found that it promotes a fake cryptocurrency token launch. The page targets holders of Pax Gold (PAXG), falsely claiming they can claim a new token called "$PAXOS." In reality, it is a cryptocurrency drainer scam designe