Our researchers discovered the CharacterGeneration application while checking out new submissions to VirusTotal. After inspecting this app, we learned that it operates as advertising-supported software (adware) and is part of the AdLoad malware group. Adware is designed to enable the pla
While investigating new malware submissions to VirusTotal, our research team discovered the RAMP ransomware. On our testing system a sample of RAMP encrypted data and modified filenames. The titles of affected files were appended with a ".terror_ramp3" extension. For example, a file originally na
After downloading and adding the Planty-Search browser extension, we noticed that it changes some settings. It hijacks a web browser to promote planty-search.com - a fake search engine. Also, it can read and change bookmarks. Our team discovered Planty-Search on a deceptive website. Planty
Our inspection of the "CTM Arrangment" email revealed that it is malspam - malicious spam designed to infect recipients' systems with malware. While this fake letter is signed off by JPS Ships Supply Service - it must be emphasized that this legitimate company is in no way associated with the sca
Autolycos is the name of Android malware that infects devices via trojanized applications downloaded from the Google Play Store. Those apps were spotted in the middle of 2021. Most of them are no longer available on the Google Play Store. Autolycos subscribes victims to its premium services.
StrelaStealer, as its name implies, is a stealer-type malware. This malicious program specifically targets email account log-in credentials. StrelaStealer was first discovered by DCSO CyTec's researchers in November of 2022. Their findings revealed that this malicious program was distributed using
Cloud 9 JavaScript BotNet refers to a malicious browser extension capable of causing chain infections, which can result in the attackers assuming near-user-level control of the device. This malware is compatible with Google Chrome, Mozilla Firefox, Microsoft Edge, Internet Explorer, and other brow
Fisakalzb is one of the Snatch ransomware variants. It encrypts files to make them inaccessible. Also, Fisakalzb appends the ".fisakalzb" extension to filenames and creates a text file named "HOW TO RESTORE YOUR FILES.TXT". That file contains a ransom note. We discovered Fisakalzb while inspecting
Our team examined datadesktopsecurity[.]online and found that it is an untrustworthy page running the "McAfee - Your PC is infected with 5 viruses!" scam. Additionally, this site wants to show notifications. We discovered datadesktopsecurity[.]online while inspecting web pages that use rogue adver
While investigating untrustworthy sites, our research team discovered the protectwatcher[.]xyz rogue webpage. It promotes online scams, pushes browser notification spam, and redirects visitors to other (likely unreliable and malicious) websites. Users typically access pages like protectwatcher[.]