Belonging to the Makop ransomware group, Baseus is a malicious program that encrypts data (renders files inaccessible) and demands ransoms for the decryption. Compromised files are retitled according to this pattern: original filename, unique ID assigned to the victim, cyber criminals' email addr
"I am sorry to inform you but your device was hacked" refers to a sextortion spam campaign. These scam emails claim that the recipient's device was infected and used to make a sexually explicit video of them. The letters demand a ransom to be paid - else the compromising recording will be publiciz
Charlie ransomware prevents victims from accessing their files (it encrypts files), modifies filenames, and displays a pop-up window ("!README!.hta") containing contact information. Charlie renames files by appending the charlieadmin@mail2tor.com email address, victim's ID, and ".!Charlie" extensi
News-themes[.]com is a rogue website sharing common traits with fast-travel.org, tionalmorei.online, expensivesurvey.live, and countless others. It operates by loading dubious content and/or redirecting visitors to various (likely untrustworthy or malicious) sites. Users typically access webpages
Variant of the Babuk ransomware, Doydo is a malicious program that encrypts data and demands payment for the decryption. Affected files are appended with a ".doydo"; e.g., a file named something like "1.jpg" would appear as "1.jpg.doydo", "2.jpg" as "2.jpg.doydo", etc. Once this process is complet
Silsautsacmo[.]com encourages visitors to receive its notifications and opens various untrustworthy web pages. It is similar to centralheat[.]me, fast-travel[.]org, joaglouwulin[.]com, and hundreds of other pages. Users do not visit such pages intentionally. Silsautsacmo[.]com is promoted
"MijnOverheid email scam" is a spam campaign. These spam emails are disguised as letters concerning a tax refund from MijnOverheid - a personal website used to deal with matters relating to the Dutch authorities. It must be emphasized that the scam emails in question are fake and in no way associa
Porn ransomware is designed to encrypt files, append the ".porn" extension to their filenames, display a pop-up window, and create the "RECUPERAR__.porn.txt" file. Porn changes a file named "1.jpg" to "1.jpg.porn", "2.jpg" to "2.jpg.porn", and so on. The displayed pop-up window and created text fi
WebSearchStreams is a potentially unwanted application (PUA) that hijacks a browser by changing its settings. The main purpose of this application is to promote a fake search engine, the websearchstreams.com address. WebSearchStreams is a PUA because users often download and install apps of this t
Abc is part of the CryptoWall ransomware family. It encrypts files and appends the ".abc" extension to filenames (for example, it renames "1.jpg" to "1.jpg.abc", "2.jpg" to "2.jpg.abc". Abc creates three ransom notes: "RESTORE_FILES.TXT", "RESTORE_FILES.BMP" and "RESTORE_FILES.HTML". Screensho