Npav Lab

A dangerous China-linked hacking group, Earth Alux, has been conducting cyber espionage attacks on major industries across Asia-Pacific and Latin America. Using advanced malware called VARGEIT, these hackers infiltrate organizations to steal sensitive data and disrupt operations.

A dangerous Android banking malware named TsarBot is spreading rapidly, targeting over 750 banking, finance, cryptocurrency, and e-commerce apps worldwide. It uses fake login screens, phishing sites, and remote control techniques to steal user credentials and execute fraudulent transactions.

Cybercriminals have devised a new social engineering attack known as ClickFix, which abuses fake CAPTCHA verifications to trick users into installing malware, including ransomware and banking trojans like Qakbot. This attack exploits users’ trust in CAPTCHA systems, leading them to unknowingly execute malicious commands.

Cybersecurity researchers have discovered a dangerous phishing campaign where Pakistani APT hackers are using a fake India Post website to spread malware to Windows and Android users. The fraudulent site, hosted at postindia[.]site, tricks victims into downloading malicious files, putting their data and devices at risk.

A new wave of Android malware is exploiting Microsoft’s .NET MAUI framework to evade detection and steal sensitive data. Disguised as banking and social media apps, this malware tricks users into installing fake applications, harvesting their personal information, and sending it to cybercriminals.

A dangerous phishing campaign is targeting businesses that advertise on Meta platforms like Facebook and Instagram. Hackers are sending fake emails claiming that users’ ad accounts have been suspended due to policy violations. These emails trick victims into clicking malicious links that steal login credentials and grant attackers full control over their accounts.

Net Protector Total Security has once again proven its strength by achieving the VB100 certification in March 2025 on Windows 11. This recognition reinforces NPAV’s commitment to providing top-tier malware detection and robust cybersecurity for users worldwide.

A new ransomware strain named VanHelsing is actively targeting Windows systems, using advanced encryption and evasion techniques to bypass security defenses. First discovered on March 16, 2025, this ransomware is particularly affecting government, manufacturing, and pharmaceutical industries in France and the United States.

The Babuk2 ransomware group has been caught making false extortion demands by recycling stolen data from past cyberattacks. Instead of launching new breaches, Babuk2 is repurposing data from older incidents and pressuring victims into paying ransoms for information that has already been leaked.

Hackers have launched a new attack using fake hotel and travel booking websites to spread LummaStealer malware. Disguised as legitimate booking confirmation pages, these fraudulent sites trick users into running harmful commands that compromise their personal and financial information.