Our researchers discovered the TabsMode browser extension while investigating untrustworthy websites. After analyzing this rogue extension, we determined that it operates as a browser hijacker. TabsMode makes changes to browser settings in order to cause redirects to the tabsmode.xyz fake search e
After testing the quick do app, we found that it is a browser extension that changes the settings of a web browser to promote a fake search engine (quicknewtab.com). Moreover, this app does not allow users to undo its changes while it is added to a browser. Apps designed to promote fake search eng
Getf**ked is the name of a ransomware-type program; throughout this article, the censoring asterisks will stand for the letters "u" and "c" respectively. We discovered this malware while inspecting new submissions to VirusTotal. When we launched a sample of this ransomware on our test system, and
Ash is the name of ransomware that encrypts files, modifies filenames of all encrypted files, and drops two files ("Decryptor.hta" and "ReadMe_Decryptor.txt") that contain ransom notes. Ash is part of the Dcrtr ransomware family. Our team discovered this ransomware variant while examining malware
Our researchers discovered the Flash ransomware-type program while checking out new submissions to VirusTotal. This piece of software belongs to the Dcrtr ransomware family. After we executed a sample of Flash on our test machine, it began encrypting files and changed their filenames. Original ti
Omerta is ransomware belonging to the Scarab family. The purpose of ransomware is to encrypt files. We discovered Omerta while inspecting malware samples submitted to VirusTotal. In addition to encrypting data, Omerta replaces filenames with a string of random characters with the ".omerta" as the
Medusa Stealer is the name of a malicious program. Described by its promotional website as a data recovery/extraction and network testing tool - it is quite evident that Medusa Stealer's intended application is far less savory. This malware is capable of stealing data, launching DDoS attacks, and
While investigating defender-pro-2022[.]xyz, our team learned that it shows deceptive content to trick visitors into believing that their computers are infected and purchasing antivirus software. This page runs the "McAfee - Your PC is infected with 5 viruses!" scam. Also, it wants to/can show dec
Ducktail is the name of an information-stealing malware. Earlier, Ducktail (.NetCore version) was used to steal Facebook Business accounts (threat actors targeted people with Facebook Business Accounts). Now, this malware (PHP version of Dukctail) is being used to steal all types of accounts (inc
We discovered the vital-scanner[.]com rogue webpage while inspecting dubious sites. This page is designed to promote scams, push spam browser notifications, and redirect users to different (likely unreliable/harmful) websites. Most visitors to vital-scanner[.]com and similar webpages enter them v