Security News > 2022 > October > Fake adult sites push data wipers disguised as ransomware
Malicious adult websites push fake ransomware which, in reality, acts as a wiper that quietly tries to delete almost all of the data on your device.
As Windows disables file extensions by default, a user would have seen a file named SexyPhotos.
Upon launch, the fake ransomware drops four executables and one batch file in the user's %temp% directory and runs them.
In reality, this fake ransomware has not stolen any data, and as previously mentioned, it's unlikely that the malware author has developed a tool to recover the files.
"Even if a decryptor is provided, renaming files to their original file name is impossible as the malware is not storing them anywhere during the infection," comments Cyble in the report.
The malware doesn't appear to be ransomware and was designed only to use the fake encryption as a decoy while deleting almost all of the files on your drives.