UpdateAgent (also known as WizardUpdate) is a piece of malware targeting Mac computers. Research shows that the latest UpdateAgent variant poses as legitimate software. It can collect certain information and install adware (and host additional payloads). UpdateAgent malware examines the
MapperIndex has two purposes: to generate advertisements and hijack a web browser (promote a fake search engine). It hijacks browser by changing its settings. As a rule, users do not download or install apps like MapperIndex on purpose. For this reason, they are categorized as potentially unwant
Rivd is the name of the ransomware variant that is part of the Djvu ransomware family. Rivd encrypts files and appends the ".rivd" extension to filenames (for example, it renames "1.jpg" to "1.jpg.rivd", "2.jpg" to "2.jpg.rivd"). Also, it creates the "_readme.txt" file containing contact and payme
EdgeManagement is designed to generate advertisements and change web browser settings to promote a fake search engine. It has the qualities of adware and a browser hijacker. Typically, apps like EdgeManagement are distributed using questionable, deceptive methods. Thus, they are categorized as p
The purpose of news-helaga[.]cc website is to redirect visitors to dubious pages and get permission to show notifications. There are hundreds of pages like news-helaga[.]cc (some examples are wydxmx[.]com, everalyearsfou[.]xyz, gofenews[.]com). All of them share the same purpose. Users do not open
Wydxmx[.]com displays a fake virus warning to trick visitors into agreeing to receive notifications from it and redirects them to other untrustworthy pages. It shares the same qualities with lots of other pages, for example, everalyearsfou[.]xyz, tterismyperson[.]xyz, news-cofade[.]cc. Wyd
Mallox is designed to encrypt files, append a new file extension (".mallox") to their filenames, and create a ransom note ("RECOVERY INFORMATION.txt" file). For instance, it renames a file named "1.jpg" to "1.jpg.mallox", "2.jpg" to "2.jpg.mallox". Different variants of this ransomware use slightl
Everalyearsfou[.]xyz is an untrustworthy page designed to promote other pages of this kind and use a clickbait technique to trick visitors into granting it permission to deliver notifications. It is very unlikely that users would visit this page on purpose. Everalyearsfou[.]xyz is similar to tteri
PUSSY is malware that blocks access to files by encrypting them and changes filenames by appending the ".PUSSY" file extension. For example, it renames "1.jpg" to "1.jpg.PUSSY", "sample.jpg" to "sample.jpg.PUSSY", and so on. PUSSY creates the "PUSSY!!!DANGER.txt" file as its ransom note. This ran
Tterismyperson[.]xyz uses a clickbait technique to lure visitors into granting it permission to show notifications. Also, this page opens questionable websites. It shares the same purpose with gofenews[.]com, untiljusttyerece[.]xyz, news-cofade[.]cc, and many other pages that users do not visit in