After inspecting this email, we determined that it is malspam. The message pretends to be a business inquiry from a travel and tour company representative planning a corporate dinner and requesting hotel bookings. In reality, its purpose is to deliver malware onto the recipient's device, so it sho
While examining suspicious websites, our researchers came across claimext[.]com, a page promoting a fake $EXT token allocation claim. The site is designed to deceive visitors into connecting their cryptocurrency wallets, which activates a drainer that transfers their funds directly to scammers.
While investigating suspicious websites, our researchers encountered voting-flap[.]com, a page fraudulently impersonating the Flap platform (flap.sh). The site invites visitors to participate in a fake voting rewards program and prompts them to connect their cryptocurrency wallets. It is, in reali
RedWing is a commercial spyware platform offered through a subscription model, targeting Android users. It is capable of intercepting SMS messages, harvesting financial credentials, recording audio and video, and granting attackers full remote control over infected devices. According to research p
MODBEACON is a Remote Access Trojan (RAT) that lets a remote operator secretly access an infected Windows computer, run commands, and load extra plugins while staying hidden in memory. According to research published by Qianxin Threat Intelligence Center, MODBEACON is used in a campaign the resea
SCMBANKER Trojan is a banking trojan built in PowerShell and aimed at users of Mexican financial institutions. According to research by Elastic Security Labs, it is part of an active, operator-assisted fraud campaign tracked as REF6045. The malware is delivered through ClickFix fake CAPTCHA pages
While examining suspicious websites, our team inspected paxolaunch[.]live and found that it promotes a fake cryptocurrency token launch. The page targets holders of Pax Gold (PAXG), falsely claiming they can claim a new token called "$PAXOS." In reality, it is a cryptocurrency drainer scam designe
We have examined this email and concluded that it is a phishing scam. The message impersonates the recipient's email service provider and falsely claims there are unresolved inbound messages requiring immediate attention. Its goal is to steal email login credentials through a fraudulent website. T
We have examined this email and determined it is a phishing scam. The message impersonates DHL Express with a fake shipment notification, then directs recipients to a fraudulent website designed to steal their login credentials. This email should be ignored to avoid exposing personal account infor
We examined this email and found it to be a phishing scam. The message falsely claims the recipient's mailbox has been restricted and urges them to verify their email account. It is designed to steal login credentials and should be ignored. The email arrives with a subject line warning of