We have inspected the email and determined that it is a fake letter regarding an important electronic fund transfer document. It is written by scammers who seek to steal personal information from recipients. Emails of this type should be ignored, and links (or other elements) in them should be lef
Edfr789 is ransomware, a type of malware that encrypts files to prevent access to them. Threat actors use it to get paid for a decryption tool. In addition to locking files, Edfr789 appends four random characters to them and generates a ransom note ("Decryptfiles.txt"). An example of how the ranso
We have examined the email and concluded that it is a sextortion scam. This type of scam typically involves a fraudulent claim that the sender has obtained compromising material, such as explicit photos or videos. Scammers behind such scams demand a ransom, often in cryptocurrency, to prevent the
Shadowpad is a modular malware that uses information-stealing modules and can cause chain infections. It has been around since at least 2017. Initially used by a single threat actor based in China, its later attacks have been attributed to multiple Chinese cyberespionage groups. The latest campai
GhostSocks is a malicious program written in the Go programming language. It is compatible with Windows and Linux operating systems. This program is a SOCKS5 backconnect proxy malware. Essentially, software of this kind is used by attackers to employ victims' Internet connections for malicious pur
Keep Awake is promoted as an app that allows users to stop their computers from entering sleep mode with just one click. However, our analysis shows that multiple security vendors flag Keep Awake (and its installer) as malicious. For this reason, we classified Keep Awake as an unwanted application
Our researchers discovered the Ad Blocker Pro Shield browser extension while investigating deceptive websites. This extension is promoted as a powerful advertisement-blocking tool that emphasizes privacy. Upon inspection, we determined that Ad Blocker Pro Shield operates as adware. Therefore, inst
Consmertestconnect[.]com is a rogue page that promotes online scams and browser notification spam. It can also redirect users to other (likely unreliable/hazardous) websites. The majority of visitors access consmertestconnect[.]com and analogous webpages via redirects caused by sites utilizing rog
Our analysis of the Ervoql App reveals that it is an unwanted application that lacks clear functionality and is bundled with Legion Loader. Installing it can cause serious issues due to the included malware's capability. Users are strongly advised to avoid installing Ervoql App and to remove it im
Our researchers found the adsforleads[.]top rogue page while investigating dubious websites. After examining this webpage, we learned that it promotes browser notification spam and produces redirects to other (likely unreliable/hazardous) sites. Users primarily access adsforleads[.]top and websit