Nyxar Stealer is an information stealer sold to cybercriminals as a subscription service. It harvests saved credentials and session data from web browsers, messaging apps, cryptocurrency wallets, and gaming platforms, and sends the stolen information to the attacker. Besides stealing data, Nyxar
We have examined this email and determined it is a phishing scam. It is disguised as an official notification about a webmail interface redesign, urging recipients to log in and retrieve emails supposedly stuck on the server. The goal is to steal email account credentials through a fake login page
We have inspected this email and determined that it is a phishing scam. The message is disguised as an official notification from cPanel, falsely claiming that the recipient's email storage is nearly full. Its goal is to trick users into visiting a fraudulent website and handing over their email l
Coffin Locker is ransomware our research team found while inspecting new submissions on VirusTotal. It encrypts victim files, appends the .coffin extension, drops a ransom note text file in every directory, and replaces the desktop wallpaper. On our test machine, Coffin Locker encrypted files and
We have examined this email and concluded that it is a phishing scam. It is disguised as a routine business communication from a contact sharing sample files through WeTransfer. The link inside leads to a fraudulent website built to steal email login credentials. This email should be ignored and d
Our team has inspected this email and determined it is malspam. The message poses as an EFT/ACH payment settlement notification to trick recipients into clicking a link. That link leads to a fraudulent website that downloads a malicious file onto the visitor's computer. The email should be ignored
We have inspected this email and determined that it is a phishing scam. The message is disguised as an urgent account-closure notice from an email service provider and urges recipients to click a verification link. That link leads to a fraudulent login page designed to steal email credentials. Thi
During our examination of sharex-network[.]live, we found that this page closely imitates the legitimate ShareX platform (sharex.network) and promotes a fake cryptocurrency airdrop. Visitors who click "Claim Your Airdrop" are presented with a wallet connection dialog designed to activate a cryptoc
While examining suspicious websites, our researchers identified stack-deckcoin[.]com, a fraudulent page promoting a fake XRP community reward. The site falsely claims visitors are eligible to claim 150 XRP tokens for free, but its actual purpose is to steal cryptocurrency by tricking users into co
Citrus Ransomware is ransomware our research team discovered while examining new file submissions to the VirusTotal website. It encrypts victims' files to make them inaccessible and demands payment in exchange for a decryption tool. Beyond encrypting files, Citrus ransomware changes the desktop w