After inspecting this email, we learned that it is sent by scammers who aim to trick unsuspecting recipients into providing personal information. The scammers behind this email are pretending to be email service providers. They use a phishing website to extract information from recipients.
Our research team discovered the Gaqtfpr ransomware-type program while inspecting new submissions to VirusTotal. We determined that this program is part of the Snatch ransomware family. When we launched a sample of Gaqtfpr on our testing system, it encrypted files and appended their filenames wit
Servidoracessobanco is ransomware that belongs to a ransomware family called Amnesia. Our malware researchers discovered it while examining samples submitted to VirusTotal. The purpose of Servidoracessobanco ransomware is to encrypt files (keep them inaccessible until they are decrypted). Additio
"Password Is Scheduled To Expire" is yet another spam email. After inspecting this letter, we determined that it operates as a phishing scam. This fake message notifies the recipient that their email account password is about to expire and requires immediate action (i.e., reconfirming the old pas
While inspecting malware samples submitted to the VirusTotal page, we discovered ransomware (which is part of the Djvu family) called Eeyu. It encrypts files and appends its extension to filenames. For example, Eeyu renames "1.jpg" to "1.jpg.eeyu", "2.png" to "2.png.eeyu", etc. Also, it drops the
Gnik is ransomware belonging to the Dharma family. Our team discovered this ransomware while inspecting malware samples submitted to VirusTotal. We found that Gnik prevents victims from accessing their files by encrypting them. It also modifies filenames and provides two ransom notes. Gnik displa
DisLight is a rogue browser extension that our researchers discovered while inspecting dubious software-promoting websites. This extension promises to enable dark mode for simple design webpages. Instead, it operates as advertising-supported software (adware). Adware enables the placement
CoolADSBlockSearch is a rogue browser extension. After analyzing this piece of software, we determined that it operates as a browser hijacker. CoolADSBlockSearch modifies browser settings to promote the cooladsblocksearch.com fake search engine. CoolADSBlockSearch reassigns browsers' homep
Our inspection of the "DHL Express - CONFIDENTIALITY NOTICE" email uncovered that it is spam. This mail operates as a phishing scam. The letter is presented as a confidential message that recipients can access by providing their email account credentials. It must be emphasized that these emails a
Our researchers discovered the protect-data-2022[.]xyz rogue site while investigating suspicious webpages. This page operates by promoting scams, pushing browser notification spam, and redirecting visitors to other (likely unreliable/malicious) websites. Most users access pages like protect-data-