Our analysis of Datarip has uncovered that it is ransomware from the MedusaLocker family. Once executed on a device, it encrypts files and appends the ".datarip" extension to them. For example, it renames "1.jpg" to "1.jpg.datarip", "2.png" to "2.png.datarip", and so forth. Additionally, Datarip
Our examination of the website (arbus[.]claims) has revealed that it is a fraudulent site crafted to steal cryptocurrency from unsuspecting individuals. The scammers copied the look of the legitimate Arbus site (arbus.ai) to deceive users. Users should be careful when landing on such pages to avoi
NETXLOADER is a .NET-based malware loader. Cybercriminals use it to deploy other malware in their attacks (e.g., other loaders or ransomware). Once on the infected device, NETXLOADER typically loads another malware first to disable defenses and establish persistence. These attacks can result in da
Our researchers discovered the flowworksfivesphere[.]com rogue page while inspecting suspect websites. This webpage endorses spam browser notifications and generates redirects to other (likely dubious/dangerous) sites. Flowworksfivesphere[.]com and similar pages are mainly accessed via redirects c
Our researchers discovered a fake "Hinkal" website during a routine investigative session. The imitator page functions as a cryptocurrency drainer – by siphoning digital assets from victims' cryptowallets. It must be emphasized that this scam site is not associated with the real Hinkal website (hi
While investigating questionable sites, our researchers discovered an application called Pdflash. This app is endorsed as a free tool that allows users to convert, merge, and compress PDF format documents. Upon examination, we determined that Pdflash is a PUA (Potentially Unwanted Application). So
We have analysed the website (flare-networkxrp[.]com) and discovered that it mimics the original/official Flare website (flare.network). The purpose of this site is to steal cryptocurrency from unsuspecting users. Thus, it is highly advisable to avoid visiting this fraudulent site and always verif
Our research team found the croursem.co[.]in rogue page while inspecting dubious websites. This webpage is designed to promote browser notification spam and cause redirects to other (likely untrustworthy/hazardous) sites. Croursem.co[.]in and similar pages are primarily accessed via redirects caus
Our inspection of the "Account Review Report" email revealed that it is spam. This is a phishing scam that targets recipients' email accounts through fake claims about soon-to-expire passwords. The spam email with the subject "Urgent! Password Notice Alert!" (may vary) informs the recipien
We have examined kurepos.co[.]in and learned that it is designed to obtain permission to send notifications using misleading methods. After permission is given, kurepos.co[.]in pushes notifications containing fake alerts and other deceptive messages intended to manipulate users into interacting wi