While investigating websites that use rogue advertising networks, we discovered uponwarmth[.]com. This deceptive website presents visitors with false information (in the guise of a fake CAPTCHA) to trick them into accepting notifications. Furthermore, accessing uponwarmth[.]com leads to other dubi
While examining the Triathlon Gurus application, we discovered that it is a browser hijacker that promotes a fake search engine called privatesearchqry.com. This search engine is not legitimate and provides search results generated by another search engine. It is worth noting that the majority of
While testing the Rapid Search browser extension, our team learned that it functions as a browser hijacker. This app promotes prosearchsolutionz.com (a questionable search engine) by taking control of a web browser (by changing its settings). Thus, it is recommended to avoid using Rapid Search and
Our researchers discovered the One Click Refresh browser extension. It is presented as a tool that allows users to refresh all tabs with a single click. Our analysis of this extension revealed that it operates as advertising-supported software (adware). Adware is designed to deliver intrus
Our research team discovered the SurfGuru browser extension while investigating untrustworthy websites. This piece of software is presented as a quick access tool to surfing-related news, advice, products, and other content. However, our analysis of SurfGuru allowed us to determine that it is a br
Our research team discovered the AdvancedParameter app during a routine investigation of new submissions to VirusTotal. After inspecting this application, we determined that it is adware belonging to the AdLoad malware family. Adware stands for advertising-supported software. It is desig
Our examination of the "Microsoft Corporation - Email Account Update" email revealed that it is spam. This letter is presented as a notification from Microsoft regarding urgent updates to the recipient's email account. This scam mail promotes a phishing website that records email passwords entered
BellaCiao is classified as dropper malware, which means it is intended to distribute other malware payloads onto a victim's computer system according to instructions from a C2 server. The payload delivered by BellaCiao is not downloaded but rather hardcoded into the executable as malformed base64
SethLocker is a ransomware-type program. It operates by encrypting data and demanding ransoms for its decryption. In most cases, malware of this kind renames the encrypted files by appending them with an extension. However, after executing a sample of SethLocker on our test machine, we learned tha
DVN is a ransomware variant based on Chaos ransomware. Our team came across DVN while checking the VirusTotal page for recently submitted malware samples. The purpose of DVN ransomware is to encrypt data. Also, this malware changes the victim's desktop wallpaper, creates the "unlock_here.txt" file