We have examined this email and concluded that it is a scam. It poses as a desperate plea from a young woman claiming to have inherited millions in gold following a family tragedy, and it asks the recipient to act as a secret business partner. The goal is to draw victims into an ongoing exchange w
Monoxide RAT is a Remote Access Trojan (RAT) designed to give attackers full control over infected Windows computers. It operates silently in the background while providing the operator with a broad range of surveillance and system-control capabilities. Threats of this kind are sold or rented to
While investigating dubious websites, our researchers came across rabbysend[.]site, a page promoting a fake airdrop using the Rabby Wallet brand. The site is designed to deceive visitors into connecting their cryptocurrency wallets, after which a drainer tool empties the victim's funds without the
TRIPAUL3 is a modular Remote Access Trojan (RAT) for 64-bit Windows, written in C++, that gives attackers extensive remote control over infected machines. The malware stores its configuration and six encrypted plugins inside the executable's overlay - a region of the file that sits beyond the sta
Upon examining xrpl-xaman[.]com, our researchers found it masquerades as an official Xaman wallet airdrop portal. The site claims to distribute 250,000,000 XAM tokens to early users, but it is a fraudulent page designed to drain cryptocurrency from anyone who connects their wallet. IMPORTANT
We have examined this email and concluded it is a phishing scam. It is disguised as an automated alert from the recipient's email administrator, falsely claiming that several incoming messages could not be delivered. The aim is to lure recipients into entering their email login credentials on a fa
We have inspected this email and determined that it is malspam. The message poses as a routine business communication requesting document review, but its real purpose is to trick recipients into downloading malware. It should be ignored and deleted. The email carries the subject "Progress
We examined this email and determined it is a phishing scam. The message poses as a confidential HR notification about staff scheduling and annual leave planning, and contains a link leading to a fake Zoho credential verification page. It should be ignored to avoid having login credentials stolen.
Penumbra Stealer is an information stealer that silently harvests credentials, session data, and sensitive files from infected Windows computers. It targets saved passwords, browser cookies, messaging platform tokens, gaming accounts, and system-level authentication data. The stealer supports 13
Nyxar Stealer is an information stealer sold to cybercriminals as a subscription service. It harvests saved credentials and session data from web browsers, messaging apps, cryptocurrency wallets, and gaming platforms, and sends the stolen information to the attacker. Besides stealing data, Nyxar