The "National Bank of Greece" email is a deceptive message distributed in large numbers via operations called "spam campaigns". These particular scam emails target Greek users. The messages supposedly concern bank transfer proposals and have a transaction receipt attached to them, however, upon o
Discovered by Jakub Kroustek, this ransomware is a part of the Dharma ransomware family. It is designed to encrypt victims' files, change the filenames, and provide instructions about how to contact the developers. It renames encrypted files by adding the victim's ID, hlpp@protonmail.ch email addr
Nypd belongs to the Djvu ransomware family. Like most ransomware-type programs, it encrypts files, changes their filenames by appending an extension, and creates a ransom message that contains instructions about how to contact the developers. Nypd appends the ".nypd" extension to files. For examp
.origami is malicious software categorized as ransomware. Systems infected with this malware have their data encrypted and users receive ransom demands for decryption tools/software. During the encryption process, all affected files are renamed according to this pattern: original filename, unique
"Apple Rewards Program" is a scam run on deceptive websites. This scheme targets Apple device users, thanks them for being longtime supporters of Apple, and claims that by completing a short survey and paying a small fee, they can win an iPhone 11 pro. This scam is in no way associated with Appl
As its name suggests, ListenToRadio supposedly provides quick access to radio stations and music websites. In fact, the main purpose of this browser hijacker is to promote blpsearch.com (a fake search engine) by changing certain browser settings. Typically, apps of this type modify settings and co
Discovered by malware researcher, Ravi, DemonWare is malicious software classified as ransomware. Typically, ransomware encrypts data and demands payment for decryption. During the encryption process, DemonWare appends all affected files with the ".DEMON" extension. For example, a file originally
Discovered by Michael Gillespie, Fonix (also known as FonixCrypter) ransomware encrypts victims' files, changes the filenames, and creates a ransom message, which is opened in a pop-up window. It renames encrypted files by adding the fonix@tuta.io email address, victim's ID, and appends the ".Foni
ConnectedBoost is an adware-type application that has browser hijacker characteristics. It delivers intrusive advertisement campaigns and modifies browser settings in order to promote fake search engines. ConnectedBoost promotes Safe Finder through search.adjustablesample.com and search.anysearc
Typically, cyber criminals behind malspam campaigns such as this attempt to trick recipients into opening a malicious file, which is attached to the email or can be downloaded through an included website link. When executed, the file infects computers with malware. This particular malspam campaign