Our research team found the menispirfly[.]com rogue site during a routine inspection of untrustworthy webpages. It is designed to promote browser notification spam, and at the time of research – menispirfly[.]com did so by employing fake CAPTCHA verification. Additionally, this page can redirect v
We have tested goodsearchez.com and found that it is a fake search engine that does not generate unique results. Typically, fake and other untrustworthy search engines are promoted mainly via browser hijackers. Our team also found that goodsearchez.com is promoted via a fake Google Docs extension.
CIA ransomware is a type of malware designed to encrypt data and make ransom demands for the decryption tools. There are two variants of this ransomware. Typically, programs of this kind alter the filenames of encrypted files; however, that is not the case with either of the CIA ransomware version
Our research team discovered yet another malicious program based on the Chaos ransomware titled Teng Snake. Malware within this classification operates by encrypting data and demanding payment for the decryption tools. On our test machine, Teng Snake encrypted files and changed their filenames. O
Xllm is ransomware based on the Chaos ransomware. We discovered Xllm while inspecting malware samples submitted to VirusTotal. This ransomware encrypts files, appends the ".xllm" extension to filenames of all encrypted files, and creates a ransom note (the "read_it.txt" file). An example of how f
Hebem is one of the Dharma ransomware variants. Our team discovered Hebem while inspecting malware samples submitted to the VirusTotal website. Hebem encrypts data and appends the victim's ID, hebem@msgsafe.io email address, and ".hebem" extension to the filenames of encrypted files. Also, it disp
Matu is the name of a ransomware variant belonging to the Djvu family. We discovered it while checking the VirusTotal for recently submitted malware samples. Matu encrypts files, appends the ".matu" extension to filenames, and drops the "_readme.txt" file that contains a ransom note. An example o
Reportyourdefenderdata[.]site is the address of a rogue website. Our researchers discovered this page while inspecting suspicious sites. The webpage promotes scams and spam browser notifications. Additionally, reportyourdefenderdata[.]site can redirect visitors to different (likely unreliable/dang
While investigating untrustworthy sites, our research team discovered the Video Finder browser extension. This piece of software claims to allow users to download the videos and images presented on any website. However, our inspection of this extension revealed that it is adware. In other words, V
Our research team discovered the aguhoa[.]com rogue page while inspecting dubious websites. This webpage runs scams, promotes browser notification spam, and redirects users to other (likely deceptive/malicious) sites. Most visitors to webpages like aguhoa[.]com access them via redirects caused by