The “Message Restriction Activity” email is part of a phishing campaign that tries to trick users into disclosing their email login credentials. The email claims that 5 new emails have not been delivered to users’ inboxes for unspecified reasons. If users want to get the emails, they are asked to click on the provided button. However, doing that would lead users…
The “Flare Airdrop” crypto scam refers to a scam that imitates the legitimate Flare platform to trick users into connecting their digital wallets to a malicious site. The main goal of these types of scams is to get users to initiate crypto drainers that would steal all the funds in the digital wallets. Flare is a legitimate base-layer blockchain that allows…
Midnight ransomware is a file-encrypting malicious program that takes files hostage by encrypting them. The malware uses military-grade encryption to encrypt files, making them unopenable. When files are encrypted, an extension is added to them, which is .midnight in this case. This allows users to identify both which files have been encrypted and what ransomware specifically they are dealing with.…
The “Hinkal” crypto scam refers to scams that imitate Hinkal, a legitimate crypto platform. Malicious actors have created an imitation site app-hinkal.cyou, that asks users to connect to their digital wallets. The legitimate Hinkal website is hinkal.pro. If users connect their digital wallets on the scam site, they will initiate a crypto drainer that will make unauthorized transfers and eventually drain…
Datarip ransomware is file-encrypting malware from the MedusaLocker family. This type of malware takes files hostage by encrypting them and demands payment for their recovery. Files encrypted by Datarip ransomware can be identified by the .datarip extension added to encrypted files. Unfortunately, files having that extension indicates that they have been encrypted and cannot be opened. Such files need to be…
ARROW ransomware will take your files hostage as it’s a file-encrypting malware. You can recognize when you’re dealing with this particular ransomware when encrypted files have the .ARROW extension added to them. Unfortunately, you will not be able to open files that have this extension unless you first use a decryptor on them. However, acquiring the decryptor will not be…
The “Account Review Report” email falls into the phishing category as it tries to phish users’ email login credentials. The email is disguised as a notification from the email service provider about recipients needing to take action to prevent restricted access to their accounts. Supposedly, users’ passwords are about to expire, and they need to choose either to keep the same…
The “HEX Airdrop” scam refers to an attempt to steal users’ cryptocurrencies by imitating the legitimate Hex website. Hex is a legitimate blockchain-based certificate of deposit (CD) system, with hex.com as the official website. To take advantage of Hex’s popularity, malicious actors have created an imitation site (events-hex.net) that tries to trick users into connecting their digital wallets and initiating a…
TXTME ransomware is malicious software that encrypts files. The ransomware is part of the Dharma ransomware family and can be identified by the extension that ends in .TXTME added to encrypted files. The extension also includes a unique ID assigned to you, as well as the malicious actors’ contact email address. Unfortunately, your files having that extension means they’ve been…
“ChatGPT malware” refers to all malicious activities performed by impersonating ChatGPT, an artificial intelligence chatbot. Due to its extremely high popularity, malicious actors often misuse the popularity for their malicious purposes. That includes disguising malware as ChatGPT apps and desktop clients, as well as distributing ChatGPT cracked versions that supposedly give users access to premium features. It goes without saying…