While checking out suspicious websites, our researchers discovered the protection-availability[.]xyz rogue page. It runs scams, promotes spam browser notifications, and redirects visitors to different (likely unreliable/hazardous) webpages. Sites like protection-availability[.]xyz are typically ac
Our researchers discovered NativeLightning during a routine inspection of new submissions to VirusTotal. After analyzing this application, we learned that it is advertising-supported software (adware) belonging to the AdLoad malware family. Adware may require specific conditions to run i
Stally[.]click is a rogue webpage that our research team found while investigating questionable websites. It operates by running scams, promoting browser notification spam, and redirecting users to different (likely unreliable or malicious) sites. Pages like stally[.]click are most commonly acces
NullMixer is a malicious program designed to cause chain infections and, as such, is classified as a dropper. This program has been observed infiltrating a wide variety of malware into infected devices, ranging from information-stealers to loaders. It is noteworthy that NullMixer is actively sprea
AbsoluteValue is an untrustworthy application we discovered while inspecting deceptive websites (e.g., websites instructing visitors to update the Adobe Flash Player). While analyzing AbsoluteValue, we found that it generates unwanted advertisements. Thus, it has been concluded that AbsoluteValu
While examining defender-box[.]xyz, we found that it is one of the many websites running the "McAfee - Your PC is infected with 5 viruses!" scam. This page displays deceptive content (fake virus warnings) to trick visitors into paying for legitimate antivirus software. Also, defender-box[.]xyz ask
CreedNetwork is a rogue application discovered by our research team during a routine investigation of new submissions to VirusTotal. We inspected this piece of software and determined that it operates as adware. It is noteworthy that CreedNetwork is part of the AdLoad malware family. Adw
Triada is the name of a Trojan targeting Android users. Cybercriminals distribute this Trojan via a modified version of WhatsApp called FMWhatsapp (and possibly other apps). Once the app with Triada hidden in it is launched, the Trojan gathers various device information to set up a communication c
Our research team discovered the Wizard malicious program during a routine inspection of new submissions to VirusTotal. It is classified as ransomware - a type of malware that encrypts data and makes ransom demands for the decryption tools. After we executed a sample of Wizard ransomware on our t
TeamDarkAnon is ransomware designed to encrypt files, change the desktop wallpaper, drop a ransom note (the "read_it.txt") file, and append the ".anon" extension to filenames. Files encrypted by ransomware cannot be opened until they are decrypted. We discovered TeamDarkAnon while examining malwar