We have examined this email and found it to be a phishing scam. The message impersonates a Google Drive file-sharing notification, falsely claiming that a client has shared documents with the recipient's team. It carries an HTML file attachment that, when opened in a browser, displays a fake login
We have inspected this email and determined it is a phishing scam. The message impersonates a generic email service notification, falsely claiming the recipient has pending messages that cannot be delivered until they take action. Its purpose is to trick recipients into clicking a link that leads
BambooToken is a backdoor-type malware that gives attackers covert, remote access to infected Windows and Linux systems. It was uncovered by Black Lotus Labs, the threat research division at Lumen, and has likely been active since at least February 2023. The malware is used in targeted attacks, m
KREMLIN Banking Trojan is a multi-stage banking trojan that secretly adds a malicious browser extension to Google Chrome and Microsoft Edge. The extension spies on online banking sessions, records what the victim types, steals cookies and saved passwords, and can even change what the victim sees o
SparroWocky is a backdoor written in C++ and deployed by FamousSparrow, a China-aligned cyberespionage group. It establishes covert, persistent access to infected computers and lets operators run commands, transfer files, capture screenshots, and route network traffic through compromised machines.
ChainScript is a Remote Access Trojan (RAT) written in Node.js that lets attackers secretly control infected Windows computers. It can run commands, handle files, take screenshots, look for cryptocurrency wallets, and install other malware. The RAT was documented in September 2026 by the Adversar
ClosedQuorum is a Windows implant classified as a trojan that combines Remote Access Trojan (RAT) functionality with credential and cryptocurrency theft. What sets it apart is its use of commercial AI language models to autonomously decide which attack action to take next, without requiring a huma
We have examined this email and determined it is a phishing scam. The message falsely claims the email provider is clearing inactive accounts and instructs the recipient to open an HTML file attachment to verify their address. The file displays a fake Zimbra webmail login page intended to steal em
We have inspected this email and determined that it is a phishing scam. The message poses as an official notification from an email service provider, falsely claiming the recipient must verify their account before a set deadline or face deletion. It is designed to steal email login credentials and
We inspected this email and found it to be a phishing scam disguised as a business purchase order inquiry. The message is designed to trick recipients into clicking a link that leads to a fake login page, where their email account credentials are stolen. This email should be ignored and deleted.