We have discovered MATILAN while inspecting malware samples submitted to VirusTotal. It was found that MATILAN is ransomware designed to encrypt files, append the ".MATILAN" extension to filenames, and generate three ransom notes. Before logging into Windows, a ransom note appears on a black scre
Qall is a ransomware-type program that our researchers found while inspecting new malware submissions to VirusTotal. We determined that this malicious program belongs to the Djvu ransomware family. After being executed on our test system, this ransomware encrypted files and appended their filenam
Hajd is the name of ransomware belonging to the Djvu ransomware family. Our team has discovered this variant on VirusTotal. Hajd encrypts files and appends the ".hajd" extension to their filenames. Also, it creates a text file named "_readme.txt". This file contains a ransom note. An example of h
Our team has discovered a new ransomware variant belonging to the Djvu family called Qpss. The purpose of Qpss is to encrypt files. Additionally, it appends the ".qpss" extension to filenames and creates the "_readme.txt" file (a ransom note). We have found this ransomware while examining malware
Systemsecuritys[.]com is a rogue webpage that our researchers found while inspecting dubious websites. This page is designed to load deceptive material, push browser notification spam, and redirect visitors to other (likely unreliable/malicious) sites. Most users enter systemsecuritys[.]com and s
After inspecting this "PancakeSwap" email, our researchers determined that it is spam that operates as a phishing scam. The letter claims that the recipient's cryptocurrency wallet will be suspended if it is not validated. This spam mail promotes a phishing page, which closely mimics the genuine P
FFDroider is a malicious program classified as a stealer. It is designed to extract and exfiltrate sensitive data from infected devices. FFDroider targets popular social media and e-commerce platforms in particular. FFDroider has been observed evading detection by masquerading as the Teleg
Datasecuritycentr[.]com is a deceptive website running the "McAfee - Your PC is infected with 5 viruses!" scam. It also asks for permission to show untrustworthy notifications. Our team has discovered datasecuritycentr[.]com while inspecting illegal movie streaming, torrent, and similar sites.
Octo is the name of the Android malware, a banking Trojan targeting Android users. Octo is pretty similar to another banking Trojan called ExobotCompact that was active until 2018 and targeted financial institutions. Octo banking Trojan has a remote access capability and uses anti-detectio
During a routine inspection of untrustworthy websites, our researchers found the "Norton Security Update Is Available Now" scam. It falsely implies that the visitor's Norton anti-virus is outdated and urges them to renew their subscription. The scam claims that a new update is available fo