We have inspected the email and found that it is a phishing message disguised as a notification about a confidential message awaiting review. It urges recipients to click a button and sign into their email account on a fraudulent website in order to steal their login credentials. This email should
LabubaRAT is a Remote Access Trojan (RAT) written in the Rust programming language that disguises itself as NVIDIA software. The analyzed sample was named nvidia-sysruntime.exe and carried fake NVIDIA version information and branding to make it appear like a legitimate system tool. According to r
Our research team found the primagrowthforge[.]com rogue page while investigating suspicious websites. After examining this webpage, we determined that it promotes browser notification spam and redirects visitors to other (likely unreliable or harmful) sites. Primagrowthforge[.]com display
Our researchers discovered forgegrowthrise[.]com while investigating dubious websites. After examining this rogue page, we determined that it promotes browser notification spam and may redirect visitors to other unreliable or harmful sites. Most visitors arrive through redirects generated by rogue
Our research team found the ascendgrowthforge[.]com rogue page while investigating suspicious websites. After inspecting this webpage, we learned that it promotes browser notification spam and redirects visitors to other (likely unreliable or harmful) sites. Ascendgrowthforge[.]com present
While inspecting dubious websites, our research team came across the worthilininence[.]com rogue page. After examining it, we determined that its primary purpose is to trick visitors into enabling browser notifications. Once permission is granted, the site delivers misleading security alerts and o
We have examined this email and concluded that it is a scam. The message impersonates the United States Department of Commerce and falsely claims the recipient has been nominated for the Trump Gold Card selection program. The goal is to trick unsuspecting recipients into paying upfront fees and do
We inspected this email and confirmed it is malspam. It impersonates a Citrix ShareFile notification about a settlement eDocument, but its real purpose is to trick recipients into installing a trojanized ScreenConnect installer. This email should be ignored and deleted without clicking any links.
We have inspected the website fomoo[.]family and found that it copies the design of the legitimate Fomo trading platform (fomo.family) almost exactly. The page is built to trick visitors into connecting their cryptocurrency wallets, which can result in the theft of their digital assets. IMPO
HYFLOCK is ransomware that we discovered while examining malware samples submitted to the VirusTotal platform. Like other ransomware, it encrypts files on the victim's computer, making them inaccessible, and demands payment in exchange for decryption. On our test machine, HYFLOCK appended the ".l