BlackMoon, also known as KrBanker, is a malware categorized as a banking trojan. It has been around since 2014 and has undergone significant changes in its multiple iterations. In the first known attacks involving this malware, it was used to target the customers of South Korean banks. The purpos
During our analysis, we concluded that this is one of the fake crypto giveaways where fraudsters impersonate famous personalities to trick people into sending cryptocurrency. This scam also involves a deepfake. This and similar web pages should be ignored and closed if ever encountered to avoid mo
SpiderParadise is ransomware designed to make files inaccessible by encrypting them. It provides a ransom note (a text file named "HOW_TO_RECOVER.txt") containing payment and contact information. Unlike most ransomware, SpiderParadise does not append any extension to files. Screenshot of files
Pentagon is a malicious program written in the Go programming language. It is classified as a stealer because it is designed to extract and exfiltrate vulnerable information from compromised devices. Pentagon operates as a stealer – a type of malware that steals data from infected systems.
We have inspected the email and discovered that it is used to trick unsuspecting recipients into disclosing personal information on a fake web page. Thus, we classified it as a phishing email. Usually, scammers behind such emails pretend to be legitimate companies or other entities. This p
Our analysis shows that OriginalAccessibility exhibits characteristics commonly associated with adware. It is designed to bombard users with intrusive advertisements. These ads can expose users to various scams and other online threats. It is also worth noting that multiple security vendors flag
OtterCookie is a piece of malicious software designed to steal information. This program has several variants, and it has been around since at least the autumn of 2024. Attacks involving OtterCookie have been linked to North Korean threat actors. This malware has been leveraged against targets as
Our team has discovered a ransomware variant based on Prince ransomware, called Hunter, during analysis of malware samples submitted to VirusTotal. Hunter encrypts data and appends the ".Hunter" extension to files. Also, it drops a ransom note ("Decryption Instructions.txt") and changes the deskto
We have tested pdf2docs.com and found that it is supposed to provide search results, but it is actually a fake search engine. Our other finding is that pdf2docs.com is promoted through an extension (PDF2DOCS) that functions as a browser hijacker. Overall, pdf2docs.com and the associated extension
Our analysis of the email revealed that it is a phishing email. It is crafted to appear as a notification from DHL (a multinational logistics company). The goal of this scam is to lure unsuspecting recipients into opening a fake web page and disclosing personal information. Such emails should be i