SpecRAT is a malicious program developed in November 2025. It is classified as a RAT (Remote Access Trojan), a type of malware that enables remote access and control over compromised machines. SpecRAT is advertised by its developers as a highly customizable piece of malicious software. Spe
Our analysis of the email has shown that this is a phishing email. It is disguised as a message from EnergyAustralia (a legitimate company in Australia) to appear legitimate and to trick recipients into opening the included website. The goal is to steal personal information that scammers can be mi
NovaStealer is a stealer targeting Mac operating systems. As the classification implies, this malicious program seeks to steal sensitive information from infected devices. NovaStealer aims to obtain data related to cryptocurrency wallets in particular. However, its modular nature could allow oth
Our researchers discovered NotHere while browsing new malware submissions to the VirusTotal platform. We determined that NotHere is a ransomware-type program that encrypts files in order to demand payment for their decryption. After we executed a sample of this ransomware on our testing system, i
MetaRAT is a variant of the well-known PlugX Remote Access Trojan (RAT). It is written in the C/C++ programming language and supports C2 commands, such as collecting system information and executing commands. It also includes additional tools, such as a keylogger. If detected, MetaRAT should be re
CastleRAT is a recently discovered Remote Access Trojan (RAT). It is designed to provide attackers with stealthy and persistent access to compromised devices. There are two versions of CastleRAT - more and less sophisticated. The latter can collect system details, download additional payloads, exe
CyberSquad is ransomware, a type of malware that prevents access to files by encrypting them. In addition to encrypting files, CyberSquad replaces filenames with a random string of characters and the ".m1nus273" extension. For example, it renames "1.jpg" to "7b95a143.m1nus273", "2.png" to "3ae172d
We have reviewed the message and confirmed it is a phishing attempt disguised as a delivery alert. It includes a link leading to a deceptive website created to steal personal information. If recipients follow the provided instructions, they could lose access to their accounts and experience additi
We have checked the message and determined that it is a phishing email masquerading as a service notification. It contains a link to a fake website designed to pilfer personal information. If recipients fall for this scam, they may not be able to access their account (or accounts) and encounter ot
Our researchers discovered webmotion.co[.]in while browsing sites that use rogue advertising networks. This webpage promotes browser notification spam and redirects users to different (likely unreliable/dangerous) websites. Webmotion.co[.]in and analogous pages are primarily accessed via redirects