NETXLOADER is a .NET-based malware loader. Cybercriminals use it to deploy other malware in their attacks (e.g., other loaders or ransomware). Once on the infected device, NETXLOADER typically loads another malware first to disable defenses and establish persistence. These attacks can result in da
Our researchers discovered the flowworksfivesphere[.]com rogue page while inspecting suspect websites. This webpage endorses spam browser notifications and generates redirects to other (likely dubious/dangerous) sites. Flowworksfivesphere[.]com and similar pages are mainly accessed via redirects c
Our researchers discovered a fake "Hinkal" website during a routine investigative session. The imitator page functions as a cryptocurrency drainer – by siphoning digital assets from victims' cryptowallets. It must be emphasized that this scam site is not associated with the real Hinkal website (hi
While investigating questionable sites, our researchers discovered an application called Pdflash. This app is endorsed as a free tool that allows users to convert, merge, and compress PDF format documents. Upon examination, we determined that Pdflash is a PUA (Potentially Unwanted Application). So
We have analysed the website (flare-networkxrp[.]com) and discovered that it mimics the original/official Flare website (flare.network). The purpose of this site is to steal cryptocurrency from unsuspecting users. Thus, it is highly advisable to avoid visiting this fraudulent site and always verif
Our research team found the croursem.co[.]in rogue page while inspecting dubious websites. This webpage is designed to promote browser notification spam and cause redirects to other (likely untrustworthy/hazardous) sites. Croursem.co[.]in and similar pages are primarily accessed via redirects caus
Our inspection of the "Account Review Report" email revealed that it is spam. This is a phishing scam that targets recipients' email accounts through fake claims about soon-to-expire passwords. The spam email with the subject "Urgent! Password Notice Alert!" (may vary) informs the recipien
We have examined kurepos.co[.]in and learned that it is designed to obtain permission to send notifications using misleading methods. After permission is given, kurepos.co[.]in pushes notifications containing fake alerts and other deceptive messages intended to manipulate users into interacting wi
We have inspected the website (chainflip-swap[.]com) and concluded that it is a copy of the original Chainflip platform (chainflip.io). The purpose of the fake site is to lure visitors into taking actions allowing scammers to steal their cryptocurrency holdings. Therefore, it is important to be ca
Our research team discovered the ARROW ransomware while reviewing new malware submissions to the VirusTotal site. This malicious program is designed to encrypt data and demand ransoms for the decryption. On our testing system, ARROW encrypted files and added a ".ARROW" extension to their filename