CrossSign is a rogue application, which our research team found while inspecting new submissions to VirusTotal. Following our analysis of this app, we determined that it operates as advertising-supported software (adware) and that it belongs to the AdLoad malware family. Adware may requi
Ttii is the name of a malicious program classified as ransomware. It is designed to encrypt data and demand ransoms for the decryption. Additionally, Ttii is part of the Djvu ransomware family. We executed a sample of Ttii (obtained from VirusTotal) onto our test machine and it encrypted files an
Mmob is a malicious program classified as ransomware. Malware within this classification is designed to encrypt data and demand payment for the decryption. Mmob is part of the Djvu ransomware family. We obtained a sample of Mmob from VirusTotal and launched it onto our test machine. This program
Allowtocontinue[.]com is a page that uses a clickbait technique to get permission to deliver notifications. It also redirects visitors to other websites. Our team has discovered allowtocontinue[.]com while examining other pages that use rogue advertising networks. It is uncommon for pages like alo
Cartech[.]space displays deceptive content to trick visitors into allowing it to show notifications. Also, it redirects to another identical page. Typically, websites like cartech[.]space are promoted via other pages of this kind. We have discovered cartech[.]space while inspecting pages that use
While inspecting shady websites, we discovered the se29[.]biz rogue page. It operates by promoting browser notification spam and redirecting visitors to other (likely unreliable/malicious) sites. Most visitors to webpages of this kind enter them through websites that use rogue advertising networks
We discovered news-tulode[.]com while inspecting untrustworthy sites. It is designed to push browser notification spam and redirect visitors to other (likely dubious/malicious) webpages. Most users enter such websites via redirects caused by pages using rogue advertising networks. The cont
While inspecting dubious download sources, our research team discovered the QuickPDFConverterSearch browser extension. After analyzing it, we learned that it operates as a browser hijacker promoting the quickpdfconvertersearch.com fake search engine. Following successful installation onto
Notadszones[.]com is a rogue page designed to push browser notification spam and redirect visitors to different (likely untrustworthy/malicious) sites. Our research team discovered notadszones[.]com while inspecting shady webpages. Users typically enter such websites inadvertently; most enter the
While checking various forums, we found a new ransomware called Pipikaki. It encrypts files, modifies filenames, and creates a ransom note. Pipikaki appends the victim's ID and ".@PIPIKAKI" extension to filenames. Its ransom note is a file named "WE CAN RECOVER YOUR DATA.txt". An example of how P