NodeSnake is a Remote Access Trojan (RAT) built to provide persistent access, conduct system surveillance, and execute remote commands. It uses various evasion techniques, communicates with Command-and-Control (C2) servers over HTTP/HTTPS, and delivers secondary payloads. At least two versions of
Our research team discovered syncchainsolutions.co[.]in while browsing suspect websites. This rogue page is designed to promote browser notification spam and generate redirects to different (likely unreliable/harmful) sites. Syncchainsolutions.co[.]in and analogous webpages are primarily accessed
Our researchers discovered the mbs-adguard[.]pro rogue page while investigating dubious websites. After examining this webpage, we determined that it promotes browser notification spam and redirects users to other (likely unreliable/dangerous) sites. The majority of visitors to mbs-adguard[.]pro
Our discovery of Smile occurred while examining malware samples uploaded to VirusTotal. Upon analysis, we concluded that Smile is ransomware that encrypts files to prevent victims from accessing them. This malware also changes the desktop wallpaper, drops a ransom note ("SM$LE-read-it.txt"), and a
We have examined smartadsboost[.]top and found that it displays misleading content to get permission to show notifications. If users agree to receive notifications from smartadsboost[.]top, they can be bombarded with fake warnings and other messages designed to open other untrustworthy websites. T
Our analysis of pherciterzorte[.]com has uncovered that it uses a deceptive technique to trick visitors into permitting it to show notifications. Once allowed, pherciterzorte[.]com displays notifications containing fake warnings and other misleading messages. Users should avoid visiting pherciterz
While browsing dubious websites, our researchers discovered the optimizedevice.co[.]in rogue page. After investigating this webpage, we learned that it promotes spam browser notifications and redirects users to other (likely dubious/hazardous) sites. The majority of visitors to optimizedevice.co[.
Our researchers found the Popup Blocker Max browser extension while investigating dubious websites. It is promoted as a tool for blocking pop-ups and other types of ads (ad blocker). Upon inspection, we determined that this extension operates as adware – i.e., it displays advertisements. A
After reading this "Google Anniversary Award" email, we determined that it is a phishing scam. This spam message claims that the recipient has been selected as a winner in an award organized by Google. It must be emphasized that this email is fake and not associated with the actual Google LLC. Th
Trendthreadlink[.]com is a rogue page discovered by our researchers during a routine investigative session. This webpage promotes deceptive content and browser notification spam. It can redirect users to different (likely untrustworthy/malicious) sites as well. Most visitors to trendthreadlink[.]