We have examined the page (qr2ws.airdrop-ton[.]homes) and found that it masquerades as the real website (ton[.]org) to lure unsuspecting individuals into participating in a fraudulent scheme. This fake page is disguised as a website hosting a cryptocurrency giveaway. Its purpose is to steal crypto
FunctionNetwork is a rogue app discovered by our researchers during a routine investigation of new file submissions to the VirusTotal website. Upon inspection, we determined that FunctionNetwork is adware from the AdLoad malware family. It operates by generating revenue for its developers throug
After investigating this "apyETH Rewards" program, we determined that it is a scam. It is presented as a platform offering APYETH (Annual Percentage Yield of Ethereum). Users unintentionally expose their digital wallets to a cryptocurrency drainer when they try to participate in this fraudulent r
While investigating new submissions to the VirusTotal site, our research team discovered the LogFormat adware. This application is part of the AdLoad malware family. LogFormat delivers intrusive ad campaigns and may have other harmful capabilities. Adware stands for advertising-supported
We have tested the HelperSignal application and noticed that it exhibits behavior typical of adware. This program delivers unwanted advertisements and may be designed to harvest data. It is worth noting that users often install apps like HelperSignal unintentionally. It is recommended for such a
After inspecting the "MEE6 Connect" (mee6-connect[.]xyz) website, we determined that it is fake. It imitates the official site of the MEE6 Discord bot (mee6.xyz). This imitator claims to provide services/information relating to digital assets. The goal is to trick users into exposing their cryptow
The "Your Password Changed" spam email impersonates a notification relating to a password change on the recipient's mail account. The purpose of this fake letter is to lure recipients into visiting a phishing website that targets email log-in credentials (passwords). It must be emphasized that thi
NICECURL is a VBScript-based backdoor malware capable of downloading additional modules, including modules created to gather various information and execute arbitrary commands. It is known that NICECURL is distributed via spear-phishing campaigns and controlled via HTTPS. Another backdoor malware
Upon examining the "Virus Activities Were Detected" email, we determined it is spam. This mail makes false claims regarding virus-related activity detected on the recipient's account. The goal is to deceive victims into providing their email log-in credentials to a phishing site. The spam
TAMECAT is a PowerShell backdoor distributed via phishing attacks. This malware provides threat actors with access to computers. Cybercriminals can use TAMECAT to control infected devices and steal various data. Cybercriminals behind TAMECAT are known for distributing another backdoor malware dubb