WatchOut #18 · Investigating
Do not install TuntunSahur malware
Website Social media Messaging app Technology & workplace scamsImpersonation
Who may be targeted: Children, parents, teachers, guardians, and young gamers who may encounter meme-related downloads shared online.
What we are seeing
TuntunSahur malware may look like a harmless meme-related download, but it uses several ZIP files and a password to hide an installer reported to be malicious. Children and young gamers may be especially interested in the theme. Do not download or run it. If it was opened, tell a trusted adult and get help.
Warning signs
- A meme or game download arrives from an unexpected website or message.
- One ZIP contains another password-protected ZIP.
- A separate file gives you the archive password.
- The extracted file asks you to install or run a program.
Reported addresses
Written so they cannot be clicked. Do not retype them into your browser.
tuntunsahur[.]sbs
Source and limitations — what this alert does not establish
- The page operator, malware family, and number of people targeted were not confirmed.
- The TuntunSahur theme may appeal to children, but the audience and distribution method were not established from the available report.
First observed Sep 9, 2026. Published Sep 10, 2026. Published by the Cybersecurity Reach Foundation.
Send this to someone it could protect.