Doommageddon is ransomware that our researchers discovered while inspecting new submissions to VirusTotal. Besides encrypting files, this group also runs a dedicated data leak site on the Tor network, where stolen files are threatened to be published if the ransom is not paid. Once it infects a de
SquadLocker is ransomware first identified by researchers at IQBlack. We investigated this threat and confirmed it encrypts victims' files, appends the .SquadLocker extension to their names, and drops a ransom note. It also changes the desktop wallpaper. On our test machine, a file named "1.jpg"
This page displays a fake Windows Security warning claiming that the system's digital certificate has expired. It does not fix anything - clicking through downloads a file that installs malware. Neither Microsoft nor Windows is affiliated with this scheme in any way. This page is a malware
We have inspected the email and found that it is a phishing message disguised as a payroll notification from a company referred to as Selectfood. It claims that information is missing from the recipient's payroll file and urges them to click a button to update it, which leads to a fake login page
This email pretends to be a Roundcube Webmail notification about mandatory security updates. In reality, it is a phishing email designed to steal email account credentials. It should be ignored and the linked page should never be used to "review" or update any account settings. The email i
We examined this email and determined that it is a phishing scam disguised as an official notification from Bank of America about a dispute claim. It urges recipients to click a link to view the dispute status, which leads to a fraudulent page designed to steal banking credentials. This email shou
We have inspected the email and found that it contains a fake notification claiming that a company mail server has been upgraded and that recipients must re-sign in to finalize the process. It is a phishing email designed to steal email account credentials from unsuspecting individuals. It should
We have inspected this email and determined that it is a phishing scam. It pretends to be a secure, encrypted HR document shared through Microsoft Purview encryption, but it is actually designed to steal Microsoft account credentials. The email should be ignored and the link inside it should not b
We have inspected the email and found that it is a phishing message disguised as an official notification from Bank of America about an approved merchant charges refund. The email is designed to trick recipients into visiting a fraudulent website and entering their online banking credentials. It s
We examined this email and found that it is a scam designed to look like an official invitation from Polymarket, the well-known prediction market platform. It promotes a fraudulent website built to drain victims' cryptocurrency wallets. This email should be ignored, and the linked site should neve