12,194guides5,441members
8 Octporterneuman.mx: PowerShell and JavaScript files tied to the AveMaria remote access trojan, and what to do8 Octdonutclientsmods.xyz: fake DonutSMP Minecraft mods tagged SilentNet, and what to do if you ran one8 Octsqpengg.com: a server handing out crypted PowerShell scripts, and what to do if one ran on your PC8 Octdonutsmpcheats.org: fake Minecraft cheat mods with the SilentNet stealer, and what to do if you installed one8 Octmaciejbi.hosting24.pl: a hosting subdomain that served Remcos scripts and a stego picture, and what to do if your PC fetched them8 Oct87130921-60-20220830152356.webstarterz.com: an open folder serving Formbook and XWorm PowerShell scripts, and what to do if one ran8 Octficus.in: picture files hiding the Remcos remote access trojan, and what to do if a script fetched them8 OctOpenDrive virus: why web.opendrive.com shows up in malware alerts, and what to do if a file from it installed Remcos
Topic · 358 pages

Password and data theft

Password and data theft: every 2-Spyware guide, news story and file page on this topic, newest first.

Dalintis
FacebookXLinkedInTelegramWhatsAppEl. paštuKopijuoti nuorodą

Latest: donutsmpcheats.org: fake Minecraft cheat mods with the SilentNet stealer, and what to do if you installed one (10/8/2026)

Newest first

Pages about Password and data theft

TrojansHigh risk

Remove donutsmpcheats.org: fake Minecraft cheat mods with the SilentNet stealer, and what to do if you installed one

donutsmpcheats.org is a site registered in September 2026 that offered Minecraft cheat clients such as LiquidBounce, Wurst and Meteor Client as .jar files. URLhaus listed seven of…Ugnius Kiguolis ·
TrojansHigh risk

Remove Cloudinary virus: why res.cloudinary.com shows up in malware alerts, and what to do if a loader fetched its pictures

Cloudinary is a legitimate image hosting service, not a virus, but criminals upload JPG pictures that hide malware and point loaders at them. In September 2026 URLhaus listed…Ugnius Kiguolis ·
TrojansHigh risk

Remove jsDelivr virus: why cdn.jsdelivr.net shows up in malware alerts, and what to do if you ran a pasted command

jsDelivr is a legitimate free CDN, not a virus, but criminals publish malware on GitHub and link to it through cdn.jsdelivr.net. In September 2026 URLhaus listed five such files:…Ugnius Kiguolis ·
Viruses and parasites

Is the TikTok Pro App Safe in 2026? No, It Is Spyware

Julie Splinters ·
Viruses and parasites

EvilQuest ThiefQuest Mac Malware in 2026: Facts and Fixes

Lucia Danes ·
Viruses and parasites

Eternity Project on Telegram: 2026 Status of the Malware Shop

Jake Doevan ·
Viruses and parasites

Agent Tesla Malware in 2026: What the Trojan Steals Now

Julie Splinters ·
Viruses and parasites

BloodyStealer and Stolen Game Accounts in 2026

BloodyStealer stole Steam, Epic and EA Origin logins in 2021. In 2026 Origin is retired, the FBI probes Steam malware games, and stolen accounts still sell.Jake Doevan ·
Viruses and parasites

Fortnite Hacks and Cheats in 2026: Malware Risks

Free Fortnite hacks and cheat downloads still spread data-stealing malware in 2026. What the fakes steal, how YouTube lures work, and how to stay clean.Jake Doevan ·
Spam and phishing

"Congratulations, You Won" Pop-Up Scam in 2026

The "Congratulations, you won" pop-up is still a scam in 2026. How the fake Google and Amazon winner pages work, what they steal and how to remove them.Jake Doevan ·
News

Minecraft Skin Malware in 2026: Are Skins Safe?

Olivia Morelli ·
Spam and phishing

The Nasty List on Instagram: 2026 Scam Guide and Fixes

Linas Kiguolis ·
News

Facebook Messenger Virus in 2026: Is This You Video Scam

Jake Doevan ·
Viruses and parasites

Can You Get a Virus From Discord? 2026 Malware Guide

Gabriel E. Hall ·
News

Telegrab and enotproject.exe: Telegram Desktop Theft in 2026

Telegrab used enotproject.exe and dpapi.exe to steal Telegram Desktop sessions. In 2026 stealers still copy tdata and key_datas. What to check and fix.Gabriel E. Hall ·
Viruses and parasites

Sniper: Phantom's Resolution Malware: 2026 Status and Steps

Sniper: Phantom's Resolution was a fake Steam game whose demo installed an info stealer. Its 2026 status, how it worked, and what to do if you ran it.2-Spyware Editorial Team ·
Viruses and parasites

Super Mario Virus: Infected Mario Forever Game in 2026

A fake Super Mario 3: Mario Forever installer dropped a Monero miner, SupremeBot and the Umbral stealer. File names, 2026 status and safe download steps.2-Spyware Editorial Team ·
Viruses and parasites

Do Porn Sites Have Viruses? Adult Site Malware in 2026

Alice Woods ·
Viruses and parasites

PirateFi Steam Malware in 2026: FBI Probe and What to Do

Gabriel E. Hall ·
Viruses and parasites

Can a Windows EXE Virus Infect a Mac? 2026 Update

Linas Kiguolis ·
Viruses and parasites

Is Valorant Malware or Spyware? 2026 Facts and Fake Cheats

Gabriel E. Hall ·
Security

16 Billion Passwords Leaked: Google, Apple in 2026

The 16 billion passwords leak was a compilation of infostealer logs and old leaks, not a hack of Google or Apple. What it means in 2026 and what to do.2-Spyware Editorial Team ·
Viruses and parasites

TikTok Malware in 2026: Vidar and StealC Scam Videos

TikTok malware videos still push fake activation commands in 2026. How the Vidar and StealC scam works, what changed since 2025 and safe steps.2-Spyware Editorial Team ·
TrojansHigh risk

Remove aqclqkcfjwbgknkwnvmm.supabase.co: a Supabase storage bucket that served SilentNet .jar files, and what to do if you ran one on Windows

aqclqkcfjwbgknkwnvmm.supabase.co is one customer project on Supabase, a legitimate cloud storage service. On 5 October 2026 URLhaus listed three .jar files in its public…Ugnius Kiguolis ·
TrojansHigh risk

Remove www.tmcksa.com: a hacked site serving a PowerShell stub for the Formbook stealer, and what to do if your PC ran it

Ugnius Kiguolis ·
TrojansHigh risk

Remove thisisafalsepositive.st: a SilentNet stealer server behind fake Minecraft mods, and how to clean a Windows PC

Ugnius Kiguolis ·
TrojansHigh risk

Remove www.beinke-aufzuege.de: a hacked website hosting FormBook PowerShell stubs, and what to do if a script fetched them

Ugnius Kiguolis ·
TrojansHigh risk

Remove flocmaterials.shop: a new server that handed out PowerShell scripts for VIP Keylogger, and what to do if one ran

Ugnius Kiguolis ·
TrojansHigh risk

Remove qpwot.cfd: a server handing out scripts that lead to the MassLogger and VIP Keylogger stealers, and what to do if one ran

qpwot.cfd is a web address that URLhaus listed seven times on 6 October 2026 for JavaScript files and PowerShell files named secured_stub.ps1, tagged MassLogger and VIPKeylogger,…Ugnius Kiguolis ·
TrojansHigh risk

Remove aksiyononline.best: a server handing out PowerShell stubs for MassLogger and VIP Keylogger, and what to do if a script fetched them

aksiyononline.best is a web address that URLhaus lists thirteen times for PowerShell and JavaScript files named Crypted.ps1 and secured_stub.ps1, three of them tagged MassLogger…Ugnius Kiguolis ·
TRHigh risk

Remove loop-lumen.com: a Mac stealer download site (AMOS, ClickFix) and what to do if you pasted its command

loop-lumen.com is a website that URLhaus lists for serving Mac malware tagged AMOS (Atomic macOS Stealer) and ClickFix, and it answered our test with a Cloudflare 520 error. If…Ugnius Kiguolis ·
Viruses and parasites

FIN7 Fake AI Nude Sites Spread Malware: Guide 2026

2-Spyware Editorial Team ·
AdwareMedium risk

Remove WebCoordinator Mac virus

Jake Doevan ·
RansomwareHigh risk

Remove Ljaz ransomware

Linas Kiguolis ·
AdwareMedium risk

Remove ViewInput Mac virus

Jake Doevan ·
MalwareHigh risk

Remove Facebook Message virus

Messenger virus might infect your device with malware and take over your Facebook account In the realm of online threats, the Facebook Messenger virus or Facebook video virus has…Lucia Danes ·
RansomwareHigh risk

Remove Nerz ransomware

Nerz ransomware is a dangerous virus that encrypts people's personal files Nerz ransomware is a member of the Djvu ransomware family, and it is one of over 600 variants. TheseLinas Kiguolis ·
RansomwareHigh risk

Remove Weon ransomware

Weon ransomware is a dangerous file-locking virus that can result in permanent damage Weon ransomware is part of the Djvu ransomware family, which includes over 600 variants.…Jake Doevan ·
RansomwareHigh risk

Remove Xash ransomware

Julie Splinters ·
VirusesMedium risk

Remove Barteu.live ads

Linas Kiguolis ·
AdwareMedium risk

Remove RecordConsole Mac virus

Jake Doevan ·
SPAM toolsLow risk

Remove "HR added you to the Working Group" email scam

Lucia Danes ·
MalwareHigh risk

Remove Facebook Friend Request virus

Facebook Friend Request virus – a malicious activity that is typically related to account hijacking Facebook Friend Request virus is a malicious [ref en-1] message that could…Ugnius Kiguolis ·
TrojansHigh risk

Remove Vagus RAT

Vagus - a dangerous Remote Access Trojan that can steal personal info and perform other malicious actions Vagus is a type of malware attributed to the RAT category. It isLinas Kiguolis ·
RansomwareHigh risk

Remove Bpto ransomware

Bpto ransomware encrypts users' personal files and demands payment to decrypt them Bpto ransomware is a malicious software that belongs to the Djvu ransomware family and is known…Lucia Danes ·
RansomwareHigh risk

Remove Znsm ransomware

Linas Kiguolis ·
RansomwareHigh risk

Remove Tcbu ransomware

Alice Woods ·
RansomwareHigh risk

Remove AXLocker ransomware

Linas Kiguolis ·
Mac VirusesMedium risk

Remove InitialMethod Mac virus

Jake Doevan ·
TrojansHigh risk

Remove CapraRAT virus

CapraRAT is Android-based malware that steals sensitive user data CapraRAT is a Remote Access Trojan that has recently surfaced in the wild,[ref en-3] mainly targeting Indian…Olivia Morelli ·
AdwareMedium risk

Remove Norton LifeLock email scam

Norton LifeLock email scam is the campaign delivering messages with false claims not related to the listed companies Norton LifeLock email scam messages were discovered when user…Linas Kiguolis ·
AdwareMedium risk

Remove Cleaner Update pop-up scam

Cleaner Update is an Android-based scam that attempts to make users download questionable software You may encounter a "Cleaner Update" message whenever you browse the web on…Lucia Danes ·
MalwareHigh risk

Remove Ducktail malware

Linas Kiguolis ·
MalwareHigh risk

Remove Luca Stealer malware

Lucia Danes ·
TrojansHigh risk

Remove DevilsTongue malware

Julie Splinters ·
SPAM toolsLow risk

Remove Your Netflix Subscription Suspended Within 2 Days email scam

Ugnius Kiguolis ·
MalwareHigh risk

Remove 3Ex2BJT2aiqDJKPAFeuWMbB4T6MhML384p malware

3Ex2BJT2aiqDJKPAFeuWMbB4T6MhML384p is the crypto wallet address of clipper malware developers 3Ex2BJT2aiqDJKPAFeuWMbB4T6MhML384p malware is used to steal cryptocurrency, Bitcoin…Julie Splinters ·
AdwareMedium risk

Remove News-waxawo.com ads

News-waxawo.com adware is the program causing issues with the machine by running the advertising campaigns News-waxawo.com can be intrusive and annoying, and this is common since…Ugnius Kiguolis ·
TrojansHigh risk

Remove 17uoEtuihi6Lsg4hdedT7PUhF4FNgBPD2F malware

17uoEtuihi6Lsg4hdedT7PUhF4FNgBPD2F is a dangerous clipper-hijacking malware that spreads via torrent sites 17uoEtuihi6Lsg4hdedT7PUhF4FNgBPD2F is a Trojan[ref en-2] that…Olivia Morelli ·

A topic collects every page that is about it; the list updates when new pages are published.

5,441 members already hereReading, writing, commenting and voting. 0 verified · 166 joined this year
All membersJoin