Qilra is ransomware that we discovered while inspecting samples submitted to VirusTotal. Our analysis has shown that Qilra encrypts files, appends the ".qilra" extension to files, and generates a ransom note ("RESTORE-MY-FILES.TXT"). An example of how the ransomware changes filenames: it renames "
Our team has inspected wexprotocol.co[.]in and discovered that its purpose is to trick visitors into agreeing to receive notifications from it. Once the page has permission to show notifications, it delivers fake warnings and similar messages. Thus, wexprotocol.co[.]in should not be trusted (and n
Our analysis of the Claim BasedAI platform has shown that it is a fraudulent scheme targeting cryptocurrency holders. Its purpose is to deceive individuals into taking actions that would result in the theft of their cryptocurrency. This and similar unofficial and deceptive websites should be avoid
HexaCrypt is ransomware designed to encrypt files. In addition to preventing access to files, HexaCrypt appends a string of random characters to files (changes their extension) and drops a ransom note "[random_string].READ_ME.txt". An example of how HexaCrypt renames files: it changes "1.jpg" to "
We have inspected hawarbarin.co[.]in and found that it uses a tactic known as clickbait to obtain permission to show notifications. If permitted, hawarbarin.co[.]in can show deceptive notifications designed to open unreliable websites. It is highly advisable not to trust hawarbarin.co[.]in and rej
Our researchers discovered this fake "Raydium Airdrop" site during a routine inspection of dubious websites. This page mimics the Raydium (raydium.io) platform. The imitator page promotes a cryptocurrency drainer that aims to siphon funds from exposed digital wallets. IMPORTANT NOTE: We do n
Our researchers discovered the "Apple Mac Security Center" technical support scam while investigating suspicious websites. The deceptive page claims to be associated with Apple and alerts the visitor of threats detected on their device. The goal is to trick victims into calling a fake support li
ResolverRAT is a malicious program classed as a Remote Access Trojan (RAT). Trojans of this kind are designed to enable remote access and control over infected machines. ResolverRAT has been used in campaigns targeting organizations worldwide. As of the time of writing, the latest campaign in Mar
Upon inspection, we determined that the "DOGE Compensation To Fraud Victims Worldwide" email is fake. This spam message claims to be from the US government offering compensation to fraud victims worldwide. This phishing mail targets recipients' personal information and may request payment at a lat
PetyaX is a ransomware designed to encrypt data and demand payment for the decryption. This malware renames the files that it alters. Original filenames are appended with a ".petyax" extension, e.g., a file initially titled "1.jpg" becomes "1.jpg.petyax", "2.png" – "2.png.petyax", etc. Afterward,