UMBRA is ransomware discovered by our researchers during a routine inspection of new submissions to VirusTotal. It encrypts files on the victim's computer, appends the ".umbra" extension to their filenames, drops a ransom note named "README_[victim_ID].txt", and replaces the desktop wallpaper with
We have analyzed this email and determined it is malspam. It impersonates Bank of America and falsely warns recipients that their account will be restricted unless they download and install a program called "Account Guard." That program is actually a remote access tool installed without the victim
WeedHack malware is a Malware-as-a-Service (MaaS) campaign that combines an information stealer with Remote Access Trojan (RAT) features, and distributes both through fake Minecraft mods and game client programs. According to research published by McAfee Labs, the campaign has been active since J
Vitya Ransomware is ransomware that locks victims' files and demands payment for decryption. It appends the .vitek extension to encrypted filenames and displays a pop-up window containing the ransom demand and a countdown timer. On our test machine, Vitya Ransomware encrypted files and appended t
We have examined this email and determined it is a phishing scam impersonating a Microsoft account security notification. The message falsely claims the recipient recently changed their password and must create new app passwords for two-step verification. It is designed to steal account credential
We examined this email and determined it is a phishing scam disguised as a legitimate account security notification from Telstra. The message falsely claims the recipient's Telstra ID was used to sign in to their account and urges them to click a link to keep their password. That link leads to a f
We examined this email and found that it is a phishing scam. Disguised as a legitimate business procurement inquiry, it tricks recipients into opening a malicious HTML file attachment. When opened, the attachment displays a fake email service login page designed to steal the victim's credentials.
We have examined this email and determined it is a phishing scam. The message poses as an urgent notification from a webmail support team, claiming the recipient's account may be deactivated due to inactivity. Its goal is to trick recipients into visiting a fake login page and surrendering their e
WARDEN Stealer is a multi-purpose information stealer, cryptocurrency address clipper, and malware loader built into a single Windows x64 executable. According to research published by KrakenLabs, the threat actor behind WARDEN promotes it on underground forums as a subscription service. The malw
Heisenberg RAT is a Remote Access Trojan (RAT) that forms the centerpiece of the Heisenberg malware platform - a modular Windows toolkit sold to other criminals. Alongside the RAT, the platform bundles an information stealer, a loader, a dropper, a cryptor, a packer, a file manager, dual hidden-de