Ande is the name of a loader-type malware. Its purpose is to infect systems with additional malicious software. The Ande loader has been used in campaigns carried out by a threat actor tracked as Blind Eagle (APT-C-36). These operations targeted Spanish speakers associated with the manufacturing
Our researchers discovered SmartViewer while investigating deceptive websites. The installer carrying SmartViewer that we inspected contained additional unwanted and potentially malicious software. Due to this and the dubious methods utilized in SmartViewer's proliferation, it is classed as a PUA
Our assessment of the PremierLeague Stats application showed that it operates as a browser hijacker. Its primary purpose is to force users to use a fake search engine. PremierLeague Stats hijacks browsers by changing their settings. It is recommended to remove apps like PremierLeague Stats from br
While browsing suspect pages, our researchers discovered remainawhile[.]com. This rogue webpage promotes deceptive content and spam browser notifications. It can also redirect users to other (likely untrustworthy or hazardous) sites. Users mainly access remainawhile[.]com and pages akin to it via
"Neoreklami" is a detection name used to identify adware, which is a type of software designed to inundate users with intrusive and often deceptive advertisements. It is important to note that adware detected as Neoreklami is often associated with other unwanted apps. Users should remove threats i
Currency Converter Tab is a browser hijacker. Our researchers discovered this extension while inspecting dubious websites. After installing Currency Converter Tab on our test machine, we learned that it modifies browsers to promote (via redirects) the currency-converter-tab.com fake search engine.
Tweaks (also known as Tweaker) is an information stealer masquerading as a tool designed to enhance frames per second (FPS) for Roblox users that steals data in the background without the user’s knowledge. After obtaining sensitive information, the stolen data is sent to a server controlled by the
Our investigation uncovered that the "Illuminati Airdrop" is a fraudulent operation masquerading as a cryptocurrency giveaway. The perpetrators of this scam employ social media platforms and deceptive web pages to swindle cryptocurrency from unsuspecting victims. Individuals must exercise caution
When examining the rososan[.]fun page, we noted that it displays misleading messages and other elements to lure visitors into taking specific actions. Also, rososan[.]fun may redirect visitors to other unreliable sites. Thus, rososan[.]fun (and similar websites) should be avoided. Rososan[
Through our investigation, we found that SanvitaliaProcumbens is an untrustworthy application distributed via a malicious installer. SanvitaliaProcumbens triggers the "Managed by your organization" feature upon being added. Furthermore, it has the ability to access and alter various data and super