Cybersecurity Reach Foundation
← All safety alerts
investigating

TuntunSahur malware uses nested password-protected ZIPs to deliver an installer

A page at tuntunsahur[.]sbs offers a TuntunSahur malware download. The first ZIP contains an encrypted ZIP, and another file provides its password. The inner archive contains an installer reported to be malicious. Do not download, extract, or run the files. The theme may make this especially appealing to children and young gamers.

TuntunSahur download page showing a completed 15.8 MB software download
The TuntunSahur page shows a fake software download before the downloaded archive reveals a password-protected inner ZIP.

Observed domain or link

  • tuntunsahur[.]sbs

What to do

  • Do not download or open the ZIP files.
  • Do not use the password supplied in another file to extract the inner archive.
  • Do not run the installer, even if it looks like a game or meme-related file.
  • If you downloaded the files but did not open them, delete them and empty the Trash or Recycle Bin.
  • If you ran the installer, disconnect the device from the internet, tell a parent, teacher, or trusted adult, and get help from a qualified technician. Change important passwords from a different clean device.

What this alert does not establish

  • The page operator, malware family, and number of people targeted were not confirmed.
  • The TuntunSahur theme may appeal to children, but the audience and distribution method were not established from the available report.

Share this warning

This alert is also on WatchOut, our shareable alert feed, with one-tap sharing and free email alerts.

Observed:
Last updated:

This alert is maintained from the shared Cybersecurity Reach Foundation / ScamArchive alert record.