We have examined this email and determined that it is a phishing scam. It impersonates the Canada Revenue Agency (CRA) and falsely claims that an official benefit statement is ready for download. The real goal is to trick recipients into surrendering their email login credentials on a fraudulent w
We examined this email and determined it is a phishing scam. The message masquerades as an automated notice from the recipient's email service provider and tricks recipients into submitting their login credentials on a fake website. This email should be deleted without taking any action. T
Devill is ransomware that we discovered while examining new file submissions to the VirusTotal website. It encrypts files, appends a randomly generated five-character extension to their filenames, changes the desktop wallpaper, and creates a text-file ransom note named Readme.txt. On our test mac
InterServer is ransomware our research team identified during a routine inspection of samples submitted to VirusTotal. It encrypts files, appends a variant-specific extension (e.g., .interserver12), and creates an HTML ransom note named RANSOM_NOTE.html. The attackers also claim to have stolen sen
Dolphin X RAT is a multi-purpose Windows malware sold as a subscription service to cybercriminals. It combines a Remote Access Trojan (RAT), information stealer, cryptocurrency clipper, and distributed denial-of-service (DDoS) tool in a single package. Research published by Varonis Threat Labs do
NoMatter is ransomware discovered by our researchers during a routine inspection of new submissions to VirusTotal. It encrypts victims' files, changes the desktop wallpaper, and drops a ransom note in a text file named README.txt. Unlike most ransomware, NoMatter does not append any new extension
BlackWizard is ransomware that our researchers discovered during a routine inspection of new file submissions to VirusTotal. It encrypts victims' files and demands payment in exchange for a decryption key. The group behind it identifies themselves as "Ransomware Team" in the ransom message. On ou
FadeSEC is ransomware our research team discovered while examining malware samples submitted to VirusTotal. It encrypts victims' files and displays an interactive full-screen ransom message. Notably, restarting or re-logging into the system dismisses the screen lock, but files remain encrypted reg
MarkiRAT is a Remote Access Trojan (RAT) used by an Iran-linked threat cluster to surveil Iranian civilians, dissidents, and diaspora communities. According to research published by Recorded Future, the malware is deployed by TAG-182, an Iran-nexus group with possible connections to the Ferocious
ClickLock Stealer is a modular information stealer targeting macOS users. According to research published by Group-IB, it was discovered in June 2026 with zero initial detections on VirusTotal. Cybercriminals distribute it via ClickFix, tricking users into running a Terminal command that silentl