PNGPlug is a malware loader used in attacks targeting Chinese-speaking regions (such as Hong Kong, Taiwan, and mainland China). These campaigns often start with phishing websites designed to deceive users into running a malicious Microsoft Installer (MSI) package camouflaged as legitimate software
After inspecting this "Claim Obol" website (claim.obol[.]bet; other domains are not unlikely), we determined that it is fake. It imitates the official site of the Obol Collective (obol.org), yet it is in no way associated with this platform. The imitator page promotes a cryptocurrency drainer that
After examining this "Bittrex Inc Bankruptcy Notice" email, we determined that it is spam. This fake message states that account holders with the Bittrex cryptocurrency exchange can reclaim their holdings, and the recipient can now transfer over four thousand USD of their digital assets. The scam
Anarchy is a malicious program designed to encrypt data and demand payment for the decryption. Due to this behavior, Anarchy is classified as ransomware. On our testing system, this malware encrypted files and appended their filenames with an "_anarchy" extension. For example, a file initially na
SlowStepper is a backdoor-type malware. Programs within this classification are intended to open a "backdoor" into systems for further infections and, in some cases – even carry them out. SlowStepper was developed at least as early as 2019. It is a sophisticated backdoor that relies on multiple m
BackConnect (BC) is malware that establishes a connection between the infected device and a command-and-control (C&C) server controlled by the attacker. The malware has been linked to the QakBot loader and has been found on the same infrastructure that was used to distribute the ZLoader malwar
Search.withaiforchrome.com is a fake search engine discovered by our researchers while analyzing the ChatGPT Search for Chrome™ browser hijacker. This extension is advertised as a tool that provides a search option with an integrated ChatGPT generative artificial intelligence chatbot. The inclusi
We have inspected the email and concluded that it is a phishing email. It is disguised as a letter regarding a request for a quotation plan and contains a link to a phishing website. The goal of the scammers behind this deceptive email is to trick recipients into disclosing personal information.
Our analysis of the site showed that its purpose is to promote a scam ("McAfee Total Protection has expired") and obtain permission to send notifications. Users should not visit baselanding[.]site and never agree to receive notifications from such pages. Doing so can lead to scams and other online
Upon inspection, our researchers determined that the "Sign-in Attempt Was Blocked" email is spam. This fake message alerts the recipient of a blocked sign-in attempt to their account. The goal is to lure recipients into visiting a phishing website that targets email account log-in credentials.