While testing the samples submitted to VirusTotal, we discovered that Maak is ransomware that belongs to Djvu family. We found that Maak encrypts files, appends the ".maak" extension to filenames (for example, it changes "1.jpg" to "1.jpg.maak", "file.txt" to "file.txt.maak"), and creates a text f
While inspecting questionable sites, our researchers encountered news-sojulu[.]cc - a browser notification spam promoting webpage. Additionally, this website can redirect visitors to other dubious and harmful ones. Users seldom access pages like news-sojulu[.]cc intentionally; most enter them via
We discovered this "METAMASK" scam while inspecting rogue websites. It is disguised as a log-in credential recovery page for MetaMask - a genuine cryptocurrency wallet designed to interact with the Ethereum blockchain. This scheme operates as a phishing scam. In other words, it aims to trick users
Skip Ads is a rogue browser extension. Based on its name, it is evidently promoted as an adblock-type software. However, following its installation onto our test machine, Skip Ads began running intrusive advertisement campaigns. Therefore, this piece of software is categorized as adware. W
ProjectSource is the name of an adware-type and browser-hijacking app that we have discovered while auditing various shady websites. After analyzing ProjectSource, we learned that the purpose of this app is to generate annoying advertisements and promote a fake search engine. After insta
We have found a new ransomware variant called Problem while inspecting ransomware samples submitted to VirusTotal. During analysis, we discovered that Problem encrypts files, appends the ".problem" extension to filenames, and creates the "readme.txt" file (a ransom note). An example of how this r
Universal-current[.]com is a shady website that displays deceptive content and asks for permission to show notifications. We have discovered it while testing pages that are using questionable advertising networks. More precisely, we ended up on universal-current[.]com after visiting various illega
During a routine inspection into new submissions on VirusTotal, our researchers detected a new addition to the ZEPPELIN ransomware family - called KUKANOS. When we tested this malware, it encrypted files and appended their filename with this extension - ".@KUKANOSSOSANOS.[victim's_ID]" (the IDs a
Our team has analyzed the InitiatorIntegrate application and discovered that it generates advertisements and hijacks a web browser to promote a fake search engine. Knowing this, we can state that InitiatorIntegrate functions as adware and a browser-hijacking application. Wile analyzing a
"Sync Wallets" is a phishing scam, which our researchers found when inspecting shady websites. Schemes of this type can be promoted on many rogue pages simultaneously; we found it on fixedvalidity[.]online website, but it may be encountered on others as well. "Sync Wallets" is presented as a dApp