While checking out dubious sites that promote software, our researchers found the Background Colors browser extension. It is presented as a tool capable of changing website background colors. However, after analyzing Background Colors, we learned that instead of working as advertised - this extens
Our research team discovered the AnalyzerState rogue application during a routine inspection of new submissions to VirusTotal. After analyzing this piece of software, we determined that it operates as adware. Furthermore, we learned that AnalyzerState belongs to the AdLoad malware family.
Captcha4you[.]top is a rogue site designed to trick visitors into allowing it to deliver browser notification spam. Additionally, this webpage is capable of redirecting users to other (likely dubious/malicious) websites. Our researchers discovered captcha4you[.]top while inspecting sites that use
Arai is a ransomware-type program that our research team discovered while inspecting new malware submissions to VirusTotal. After launching a sample of this ransomware on our test machine, Arai encrypted data and created a note demanding a ransom for the decryption. The names of the encrypted fil
Politicosta[.]biz is one of the many websites that use clickbait techniques to trick visitors into allowing them to show notifications. We encountered this site while inspecting other pages that use rogue advertising networks. One more reason not to visit/trust politicosta[.]biz is that it can red
Good Blocker is described as a browser extension that blocks online advertisements. We discovered this app while examining a technical support scam website. After downloading and adding Good Blocker, we learned that it is an advertising-supported application - it shows annoying advertisements.
We discovered malware named Kamikizu while examining the samples submitted to the VirusTotal website. After inspecting Kamikizu, we learned that it is ransomware that encrypts files, modifies filenames, and drops the "!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT" file (a ransom note). We also found th
While inspecting new submissions to VirusTotal, our research team found the TaskPost application. After analyzing this rogue app, we learned that it is adware. Additionally, this piece of software belongs to the AdLoad malware family. Advertising-supported software (adware) enables the p
TwinValley is an application designed to bombard users with intrusive advertisements. It has no useful features and can cause certain problems. Our malware researchers discovered TwinValley while inspecting deceptive pages promoting fake installers. Since TwinValley displays unwanted ads, we cla
69 is the name of a ransomware-type program. Malware within this classification is designed to encrypt data and demand payment for the decryption. We obtained a sample of this ransomware and executed it on our test machine. The malware encrypted files and appended their filenames with a ".69" ext