AvisLoader is a Windows malware loader - a program whose main job is to get a foothold on a computer and then download and run other malicious software on it. It was described by Varonis Threat Labs after researchers came across an exposed staging server holding the loader, its helper tools, a fak
Hirudo is an Android banking trojan with remote access capabilities. According to research published by ThreatFabric's Mobile Threat Intelligence team, it combines on-device credential theft with live remote control of the infected device. Hirudo is distributed through lure apps disguised as shopp
Hexsomeware is ransomware our research team identified while examining new malware samples submitted to VirusTotal. It encrypts files, appends a .hexsomeware extension to filenames, and presents ransom demands through a full-screen pop-up and a dropped text file. On our test machine, every encryp
Has is a ransomware-type program and a member of the Dharma ransomware family. Our research team identified it while analyzing new malware submissions on VirusTotal. It encrypts victim files and demands payment for decryption, also threatening to leak data it claims to have stolen. On our test ma
Lunex Stealer is an information stealer that grabs saved passwords, cookies, credit card details, and cryptocurrency wallet data from infected Windows computers. It is part of the Lunex platform, which is sold to cybercriminals as Malware-as-a-Service, meaning different criminal groups rent the sa
Corp MDM is Android spyware that targets employees of logistics companies. It silently intercepts SMS messages and redirects calls to steal authentication codes. According to research by Have I Been Squatted, the campaign is linked to cargo theft operations. Corp MDM presents itself as an
RemControl is an Android banking trojan and Remote Access Trojan (RAT) targeting retail banking customers across Western Europe, the Middle East, and Canada. It operates as a Malware-as-a-Service (MaaS) platform. According to research published by Group-IB, the malware was first identified in July
While inspecting a rogue installation setup, our researchers found the Quick Search browser hijacker. This extension modifies browser settings to promote find.flashysearches.com, a fake search engine. Quick Search is also a privacy concern. Software in this category typically monitors users' brow
We have inspected this email and determined that it is a scam. The message is disguised as an official notification from a webmail hosting service, falsely claiming that the recipient's account migration has been suspended. It is a phishing email designed to steal email account credentials from un
We have examined this email and determined that it is a scam. The message impersonates Odido, a legitimate Dutch telecommunications provider, falsely claiming that a down payment for a mobile device is outstanding. Its purpose is to trick recipients into sending money to fraudsters. This email sho