We inspected this email and confirmed it is malspam. It impersonates a Citrix ShareFile notification about a settlement eDocument, but its real purpose is to trick recipients into installing a trojanized ScreenConnect installer. This email should be ignored and deleted without clicking any links.
We have inspected the website fomoo[.]family and found that it copies the design of the legitimate Fomo trading platform (fomo.family) almost exactly. The page is built to trick visitors into connecting their cryptocurrency wallets, which can result in the theft of their digital assets. IMPO
HYFLOCK is ransomware that we discovered while examining malware samples submitted to the VirusTotal platform. Like other ransomware, it encrypts files on the victim's computer, making them inaccessible, and demands payment in exchange for decryption. On our test machine, HYFLOCK appended the ".l
We have inspected this email and determined it is a phishing scam. Disguised as an official mailbox migration alert, it falsely claims the recipient's email account transfer has failed and requires their immediate attention. Its purpose is to direct users to a fraudulent login page where their ema
We have examined this email and concluded it is a scam. The message falsely claims the recipient has earned $7,146,325.16 in cryptocurrency through a fabricated "Digital Money Market Funding System" and instructs them to contact scammers via Signal messenger to claim the funds. This is an advance-
After inspecting this email, we determined that it is malspam. The message pretends to be a business inquiry from a travel and tour company representative planning a corporate dinner and requesting hotel bookings. In reality, its purpose is to deliver malware onto the recipient's device, so it sho
While examining suspicious websites, our researchers came across claimext[.]com, a page promoting a fake $EXT token allocation claim. The site is designed to deceive visitors into connecting their cryptocurrency wallets, which activates a drainer that transfers their funds directly to scammers.
While investigating suspicious websites, our researchers encountered voting-flap[.]com, a page fraudulently impersonating the Flap platform (flap.sh). The site invites visitors to participate in a fake voting rewards program and prompts them to connect their cryptocurrency wallets. It is, in reali
RedWing is a commercial spyware platform offered through a subscription model, targeting Android users. It is capable of intercepting SMS messages, harvesting financial credentials, recording audio and video, and granting attackers full remote control over infected devices. According to research p
MODBEACON is a Remote Access Trojan (RAT) that lets a remote operator secretly access an infected Windows computer, run commands, and load extra plugins while staying hidden in memory. According to research published by Qianxin Threat Intelligence Center, MODBEACON is used in a campaign the resea