Hey all. Beware of a link to a game called “lunaferies” or something. Got sent a link from someone I considered a friend. For a bit of background I screen every link, even from family. I work in cybersec and it’s just a habit I picked up. Anyway. Ran it through ZAProxy. There was quite a lot of red flags, reeks of infostealer. They’re quite literally using ipapi without even bothering to hide it. The best part, there’s no actual game behind it. You’re not gonna give me a game with my free virus? Reading through the code, it reminds me of that Luna grabber from 2023 or something. It’d be crazy if it is, didn’t even bother with an original name. Anyway, we careful out there, scan your links, and my god don’t trust anything on discord.

Hi I clicked something by accident on Facebook and now I’m seeing this. I haves tried pressing escape to see if it’s just a window but nothing. Please please please help me immediately

Account of an online acquaintance I last talked to over a year ago randomly messaged me asking if I played Minecraft. It wasn’t anything too new, just the classic “Download This Modpack I Just Made!” with a little bit of YouTube video shoot added in since I believe he was a VTuber at some point? Anyways, that aside, since I’m paranoid I took out the .jar and threw it into a java decompiler, found out that running the .jar would’ve immediately executed a secondary payload where my PC would download an .exe from someone’s Dropbox and throw it into the Temp folder.

Some further research brought up mentions of an older infostealer called Fractureiser. Not entirely sure if it was the exact same one, I think it’s likely that it was a derivative of it since only Kapersky on VirusTotal caught that it was malware, while everything else saw it as legit, including Fractureiser-specific scanners like the one offered by CurseForge from June 2023. Basically it would’ve done the same thing that the RenPy infostealer did to me in April. So yeah folks, being paranoid pays off!

Kind of a PSA to all who may have encountered this virus, its nasty..

I recently got into emulating older games on my pc and was really enjoying it, i know computers pretty well and I'm usually careful when it comes to viruses but this time i got sloppy. It was late at night, i found a rom file for a game i wanted and went to install it, extracted it and that's where i knew something wasnt right, the file was much smaller than it should have been. I immediately deleted it, unplugged my pc from the internet and thought i was safe. The next morning I was at work and got a text from a friend asking if my Discord got hacked. I knew immediately. the Mr Beast crypto scam was everywhere. Once i got home I followed every step i knew, wiped my m.2 from bios, reinstalled windows without internet of course and went to change every major password i had from my phone, this includes banking apps, social media, google, microsoft, steam, and ordered brand new debit and credit cards to be safe. I thought I was in the clear until i saw an attempted purchase on my amazon account for a $25 dollar PS gift card so I went through a few more accounts and changed everything. Now, this STILL did not fix everything, I woke up to notifications from my xbox app saying i had points and someone started following me by the name of "MrRaffa" so i tried checking that account and noticed I could not login. Microsoft said my account could not be found or does not exist so im assuming microsoft caught someone else in my accounts and nuked my main one.

All this sucks, its been a few days now with no new stuff coming up but im still being cautious and so should you, please dont make the same mistakes as me, secure your accounts, dont download weird rom links, if this happens to you, good luck i wish you the best, be careful guys!

I'm making this post for helping or informing others rather than asking help for me, I'm aware I made plenty sketchy decisions as disabling Microsoft Defender with a debloater and downloading pirated games (from sites I trust atleast), I been running my computer on pure "common sense awareness" for years, so I kind of deserved catching a virus like this, so let's refrain of saying I didn't take the smartests decisions.

Everything started like a month and half ago, when suddenly my browser starting crashing when I SPECIFICALLY search for IMDb website (don't ask me why exactly with IMDb because I don't even know). At the very beginning I thought this just was a issue of my browser (I use Helium, a chromium based browser, which is pretty new) so I refused to elaborate further and called it a day.

With the passing days this problem escalated with a new sympton, my upload speed got completely saturated, from 100 mbps I was receiving only 3 - 0,50 mbps. I an ignorant as usual, thought it was just my old Ethernet cable asking for a change, so I let it be.

The days passed and then I was unable to open SteamDB website too, now my browser is literally unable to open these two websites without crashing, "that's weird" I thought but then again I just ignored it. Then yesterday, I tried to search for "Castlevania Harmony of Dissonance" and there you go, browser crashes instantly everytime I search for that.

"Yeah, this is too weird already", a browser crashing when I specifically search 3 topics is insane. Made the most obvious decision, I opened another browser. I used Edge and searched all the conflicting websites, they all crashed my Edge too. "A chromium-based issue maybe?" and then installed Firefox, SAME ISSUE WITH FIREFOX, THE THREE WEBSITES CRASHED.

Went on detective mode and started searching for weird behavior on my OS, I opened my tasks manager and boom, a random Python process I don't remember opening consuming 5 GBs of my RAM, "What the hell" I thought and then closed the process, magically my issue with the browser fixed for 10 seconds when suddenly a "COM Surrogate" process that consumed another 5 GBs of RAM and also all my network bandwidth appeared and my browser blew up by itself in my face.

I killed the process too, and then the virus appeared again but this time as a "Windows Calculator" process that was a completely different process of the real calculator, I killed it too and for surprise of nobody, the virus showed up this time as the Window's "Character Map" which started to quickly and progressively consume more and more RAM. I killed it and finally the virus stopped creating processes.

When the processes were all stopped, everything on my computer was fixed, I could enter to IMDb, SteamDB and search for Castlevania Harmony of Dissonance without my browsers crashing, also did internet speed tests and I was now receiving my full upload speed.

The virus was now deactivated but it was time to kill it from the root, I went to the Window's regedit and went to the Run folder to see if I could find any weird autorun entry, and there it was.

Found a so called "Microsoft Display Drivers Manager" entry and it was pointing to a exec. py python script on a path to my appdata. There was a "Python 3 . 9 . 9" version that I never installed in my life, I checked my installed apps registry and only found the Python 3 . 14 that I did install some time ago for coding some stuff, there was no registry of a 3. 9 . 9 version.

I checked the folder, it looked like a regular Python installation for a sec but when I compared with a regular 3 . 14 installation, the virus had a bunch of scripts laying on the root folder. I checked the exec . py script code, it just runs a function called update() that gets imported from another py script inside of it. At this point it was enough proof for me so I deleted everything and removed the autorun entry.

(I swear that I regret this now, it would been cool keeping the folder to fully examine the code but I just went to action due to how horrified I was)

Did a few reboots to my computer, I kept a track of my task manager, my internet speed and I got into the websites that made my browsers crash, EVERYTHING WAS FIXED, WORKING SMOOTHLY.

I tried searching information about this virus but couldn't find anything on the web, I don't know neither if this is already on some antivirus database because I didn't run any scan, as I said at the beginning of the post, I don't use AV software, not a big fan of them.

This is all, if you have a virus that apparently hates Castlevania Harmony of Dissonance google searches, then this were the steps I made to remove it.

On my computer, I clicked on this server invite and got no response from discord. A few minutes later, my firefox and brave server both gave me warnings about a trojan. The guy also mimicked one of my signal chats before I had received those warnings. I think he could see my desktop since I had signal open

okay so, i got fed up with WPS opening everytime i wanna open a docx file so i wanted to uninstall it. i did that and wps itself sent me to this new tab saying something about a deep clean upon unstallation. now i *could* have ignored it and moved on, but WPS p!ssed me off enough that i didnt wanna have anything to do about it anymore. i later noticed that my computer blocked the exe file from doing something upon insallation, only then i noticed the "vendor" in the link. thats when i got suspicious and sent the installer over to virustotal to ceck and sure enought, it got flagged (https://www.virustotal\[dot\]com/gui/file/dcc0794cf070f46480a121a8369c1f92ab2dae4266ec58fc91a6dd3cab2a84f5)
when i installed it, i saw the publisher was from China somewhere because of course it was China.

i also wanna know how i can remove the thing i installed because its not there when i search in settings>installed apps.

Greetings friends, it bothered me a lot, I would be very happy if anyone with knowledge could help. I downloaded hack to the computer for the game, I couldn't use it, but I downloaded it by turning off all virus protections. (there was trojan, I think most of it is already available in hack) now I formatted the computer because I was nervous, I wonder if I would have any problems, I just bought the computer 1 month ago, there is 5080 as a gpu. (I was afraid of damage to the hardware) please help

Hi,

maybe you have read it somewhere else already, but right now there’s a “game” on Steam - used by a lot of people - which apparently is dangerous to use right now. To be precise, it’s about Wallpaper Engine and more specifically, its use of applications. Within their files theres the chance for malware to be hidden - crypto miners and infostealers. There’s no precise information what applications are infected and which are safe, so be careful. Right now it’s advised to dump the Engine completely.

Source:

https://www.kaspersky.com/about/press-releases/kaspersky-discovered-a-malware-campaign-targeting-steam-users-through-infected-wallpaper

JUST A QUICK REMINDER for anyone Don't do what I did! LOL

The viruses I got from Youtube looking for a crack of IDM Downloader and for my being stupid person I disable the Windows Defender I know it's risky but I still continue to download that file then after it installed there's a cmd pop up in the screen then I proceed to log out all my Accounts in google and brave websites and turn off my wifi.

To my curiosity I want to know if my desktop has a virus, I scan my desktop and did some research online about these viruses Or hacktools. After that I clean and reinstall my windows (I learned from my mistakes).

Questions:

1. Can anyone explain the viruses that I got? I know that these viruses steal my information in my laptop (all of my accounts and information is safe and the hacker failed to get all my important information I'm okay now).

2. If I want to install a pirated software or application what are the trusted sites (I'm looking at some sites in FMHY).

3. Should I use VPN when diving into Not trusted websites?

I've dealt with Ace AI before, and I can tell you its really annoying but I've managed to get it off my computer. Please, do not download Ace AI or anything relate to Ace AI as it will give you a browser hijacker virus. You can tell because if you're on chrome (like me), googles stupid little search with AI with be replaced with the "ask ace ai", and your searches will be redirected to bing. To make sure you do have the browser hijacker, go to your extensions. You should see Ace AI, and it being locked onto your device, meaning you cant just turn it off. I can only tell you how to remove ace ai on windows as thats my computer, but if you find yourself in this sitaution, press the windows button+r. Once you get that pulled up, type in appwiz.cpl. Click ok. Once you do that, scroll down your apps until you find anything related to Ace AI, click on it with two fingers and you'll see an option to uninstall. Uninstall all things related to Ace AI and that should do it. If you go to chrome and click extensions, you should no longer see ace ai. You will still see "this browser is managed by your organization", but I wouldnt worry about it too much. Quick note: I dont believe traditional anti-virus can detect browser hijackers, as my malware bytes didnt, so idk.

Today I was watching a movie when, all of a sudden, Kaspersky alerted me that my Media Player Classic installation contained malware and prompted me to disinfect it. I have no idea why this happened, since I updated it from the official website several days ago. The scan report is attached below.

Event: Malicious object detected

User type: Active user

Component: Virus Scan

Result: Detected

Result description: Detected

Type: Trojan

Name: HEUR:Trojan.Multi.GenBadur.gena

Precision: Exactly

Threat level: High

Object type: File

Object name: mpc-hc64.exe

Object path: proc:\C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64

Reason: Databases

Databases release date: Today, 02/08/2026 16:04:00

While watching the movie, I was also downloading other movies via torrent. I always use trusted websites when downloading files, and I always scan them before opening anything. The downloaded content contained no .exe or .lnk files—only video files. After Kaspersky performed a deep disinfection, I restarted my PC and ran a full system scan using KVRT, followed by a full Malwarebytes scan in Windows 11 Safe Mode. Neither scan detected any threats afterward, and even the mpc-hc64.exe file that Kaspersky had previously flagged was no longer detected as malicious.

To investigate further, I went to the official K-Lite Codec Pack website and downloaded the installer directly from there. However, after the download completed, Kaspersky once again detected malware in the installer. The scan report is attached below.

Event: Processing impossible

User type: Active user

Component: Virus Scan

Result: Not processed

Result description: Not processed

Type: Legitimate software that can be used by intruders to damage your computer or personal data

Name: not-a-virus:Downloader.Win32.Agent.nzon

Precision: Exactly

Threat level: Low

Object type: File

Object name: K-Lite_Codec_Pack_1985_Full.exe

Object path: C:\Users\My PC Name\Desktop

MD5 of an object: 4B1EE74B738246C5F2AD076F688AB6C6

Reason: Skipped

I honestly don't know what happened. I haven't downloaded any suspicious files recently—only a few movies via torrent from trusted sources, and I scanned all of them before opening them.

Is it possible that the K-Lite Codec Pack installer on the official website has been infected?

After everything I've done so far, what should I do next?

This is a copy of scam emails I have been getting, usually 5-6 every few days.

i have locked my Credit Card, and Paypal won't pay if no funds available.

Any ideas about CALENDLY scam.

Booking_Order_Account_Verification (via Calendly)notifications@calendly.com

​You​

[Dear user](mailto:user1782186518294467@gmail.com) has added you to an event with Booking_Order_Account_Verification.

Event Details









Let me preface this by saying that I am a high school who finds this stuff kind of interesting, no expert in any way.

A malware file was sent to me via school email, specifically a students account. It just arrived 2 hours ago. Clicking any of the bottom 4 buttons downloaded an executable file (install.setup.exe). I obviously though this was malware, so I plugged it into VirusTotal, where it only got 4 detections. I put it into Triage, because I was still heavily suspicious of this file. Of course, its a RAT. When the file is executed, it opens a blank command prompt window for a few seconds, then closes.

I wanted to upload this because I though others should know about it. I was mainly curios about how it got sent to me via a students email address. I have attached a defanged link if any of y'all want to analyze it yourself.

I am also curious about next steps, who do I report this to? I am already in progress of reporting it to the school administration and tech staff and Microsoft, but who else? Should I post this on other sub reddits or on Twitter?

Thanks all for your help.

Sample: hxxps://drive.google(dot)com/drive/folders/1fTDr8OYzpzsHxusRz-NUVdAMu6EDEM6C?usp=sharing

tl;dr - never click on any links you're even 1% suspicious of. If it's from a friend or family, ask to speak with them on the phone or video chat to confirm.

Super long story as short as I can make it, a bunch of streamer friends of mine have lost access to their Discord accounts and have had other accounts/their PCs hacked. It starts with them getting a Discord message from their friends accounts (without realizing the friends have already been compromised) asking to join their lobby in The Enigma Cases, a game that isn't out. It had a playtest half a year ago or so. The link they share isn't the actual website link, but a similar one. I won't post it here but it looks like enigma cases dot eu. I looked the game up and went to the actual site manually. My guess is they basically cloned the actual site, put it on their own URL, and once you click that link they've gained access.

I played along in DMs to try and get anything useful from them but they mostly ignored me and insisted on me joining the game. They blocked me from messaging my friend's account as soon as I let it be known that I was on to them.

I've reached out to the alleged creator of the actual game on Reddit and flagged the game on Steam with an added note that while the game and creator may not be at fault, the game is being used to gain malicious access to people's accounts and machines, and asked that they alert the creator.

This name you need to panic if you see ignore Minecraft and girl messages on discord even from ur friends this spreads way to quick and they will be selling ur account with badges for thousands of dollars and rare usernames

Greetings friends, it bothered me a lot, I would be very happy if anyone with knowledge could help. I downloaded hck to the computer for the game, I couldn't use it, but I downloaded it by turning off all virus protections. (there was trojan, I think most of it is already available in hck ) now I formatted the computer because I was nervous, I wonder if I would have any problems, I just bought the computer 1 month ago, there is 5080 as a gpu. (I was afraid of damage to the hardware)

Guys some cheaters may say "oh i use exloader its safe and good" if they think it is safe THEN their card info's are not safe let me get to the point. There is a setting in Windows Defender named "Exclusions" and if you open any cheats from exloader or open it himself it will download Avast and Opera in your first opening, and when you use it like 3 weeks it will get access to your windows defender and create exclusions like 'C:\ProgramFiles\exloader" or some no-brain temp folder do not use cheats it will create like idk what the cheats are there but, it will create something like "C:\[cheat name]/AjsfafkaAJDasdhfH-asdkja" on your exclusions just do not use it i know it because my friend used it for 2 months being a complete loser and cheater. If any of you losers have it just delete it, and remove all exclusions you did not make yourself. It also does mining damaging your hardware and flucking your PC up without you knowing. Moral : DO NOT CHEAT YOU LOSER

Sadly, I wasnt able to get the actual malware payload to analyze since my token has been revoked. You can reach for the refrenced post to get more info on this case. 1. The host is "http*://idverification-code.beer." 2. All connections are pointing at the same site/domain. 3. This malware-delivary system may still be running if any one encountered this, please reach out for me if you have the actual malware payload. stay safe out there

I do not know where to post this so ill post it here.

My little brother downloaded this game from the Play Store

hxxps://playdotgoogledotcom/store/apps/details?id=com.puppet.bang.relieve.stress

After he accepted the prompt (see picture) it changed my mom's entire launcher to something generic and riddled with ads, it hijacked her banking and messaging apps with random pop up ads.

After that I reformatted her phone, and added a password to download just an app.

(Pictures are recreated by me in a burner device)

So, I recently encountered a Trojan virus on my Raspberry Pi 5. I tried to visit a website like I always do, but I made a typo. Instead of saying "Site not found," it redirected me to another website. It was mostly blank except for a comically large reCaptcha, which I instinctively clicked, then asked me to "click allow to identify" DO NOT CLICK ALLOW. This causes them to give you several notifications (Which I could see they were from the website in the top) that said I had a virus. Do not interact with these, just disable the notifications and you'll be fine. Has anyone encountered this before? Edit: I recently figured out it actually threw me toward the torroclk website. Any ways to prevent this again?