We have examined this email and determined it is a phishing scam disguised as an official QuickBooks Online Accountant invitation from Intuit. Clicking the link inside leads to a fraudulent website designed to steal email credentials from unsuspecting recipients. This email should be ignored.
We have examined this email and concluded that it is a phishing scam. The message impersonates an automated notification from an email service, falsely claiming that some of the recipient's messages are pending due to an account issue. It is designed to steal email login credentials and should be
PEEP RAT is a malicious browser extension disguised as a bookmark manager called "Smart Bookmarks." According to research published by SOCRadar, it is a remote access trojan (RAT) designed to turn compromised browsers into host-level backdoors. We analyzed this extension and confirmed it steals se
DarkTortilla RAT is a Remote Access Trojan with significant information-stealing capabilities. It quietly harvests saved browser passwords, session cookies, and payment card details from infected machines without displaying any visible signs of activity. According to analysis published by kaandem
ZigCryptoStealer is a cryptocurrency-stealing malware written in the Zig programming language. It works as a clipper - it watches the Windows clipboard and, when the victim copies a cryptocurrency wallet address, quietly swaps it for an address that belongs to the attacker. Payments the victim thi
PollCat is a Remote Access Trojan (RAT) written in obfuscated JavaScript. It gives attackers remote control over infected computers, letting them run commands, steal files, manage processes, and execute additional code. PollCat is cross-platform and works on Windows, Linux, and macOS. Kaspersky r
NodeRabbit is a Remote Access Trojan (RAT) written in Node.js. It lets attackers secretly run commands, manage files, collect information about the device and network, and load additional code on infected computers. The malware is cross-platform and works on Windows, Linux, and macOS. Kaspersky r
We have examined this email and determined it is a phishing scam. The message is disguised as a legitimate business purchase order and carries an HTML file attachment. Opening the attachment reveals a fake Adobe-locked document interface designed to steal the recipient's email password. This email
We have inspected this email and determined that it is malspam. The message impersonates official correspondence from Absa bank to trick recipients into opening an attached PDF file. That PDF contains a link which downloads a malicious script designed to inject malware onto the victim's device. Th
Overbridgenet.com is a domain contacted in the background by an adware-type browser extension. We analyzed the campaign after it was documented by Qi'anxin Threat Intelligence Center, which named the extension responsible "Ghost Extension". The extension adds sponsored shopping results to Google