Sable Squirrel Uses Expired Domains for Streaming and Malware
Infoblox says Sable Squirrel bought more than 10,000 expired domains for illegal streams, betting redirects, and malware command-and-control. Here is what visitors should check.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
Fake CCleaner Installs GhostDesk Chrome Spyware
A counterfeit CCleaner installer adds GhostDesk spyware to Chrome, stealing cookies, credentials, screenshots, and clipboard data. Check exposure…
Zoom Zero-Click RCE CVE-2026-53413: Update Now
CVE-2026-53413 let a Zoom meeting participant run code on another participant’s device without a click. Check the fixed…
Guides
View all
Is FlixHQ Safe? Domains, Apps, Pop-Ups, and Recovery
The FlixHQ name can point to different domains, players, apps, APKs, and payment pages. Learn how to identify what you used and…
Repair desk
View all
Is Medal Safe? Virus Alerts, Recording, and Privacy Checks
Learn how to verify the official Medal recorder, handle antivirus alerts without broad exclusions, and review clip, upload, and privacy settings.
How Malware Abused Paste.tc: XWorm, LimeRAT, and AsyncRAT Cases
A cross-case investigation of how AsyncRAT, LimeRAT, and XWorm used Paste.tc raw pages as C2 resolvers or PowerShell stages, with behavioral hunts and careful attribution boundaries.
Plushiefun.xyz PowerShell Chain Found Under HP Task Identities
Gridinsoft Labs observed plushiefun.xyz on nine endpoints where activity under Hewlett-Packard Diagnostics task identities led into…
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it,…
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Why Antivirus Flags Old Bookmarks and URL Shortcuts
Old Favorites and .url shortcuts can be flagged when saved sites become phishing, scam, or adware…
SF Express E-Invoice HTML Phishing Kit: Technical Analysis
A technical analysis of an SF Express e-invoice HTML attachment that steals email passwords through Telegram…
Runechat.com Scam: RuneScape Casino Phishing Warning
Runechat.com is flagged as phishing with a 3/100 trust score. Learn why not to log in,…
Latest from every desk
Troubleshooting
Svchost.exe Virus in AppData or Temp: How to Spot and Remove a Fake
Learn where real svchost.exe belongs, how to verify its signature and hosted service, and…
Troubleshooting
RuntimeBroker.exe Virus? How to Spot a Fake Process and Remove It
Learn where the real RuntimeBroker.exe belongs, what high CPU means, how to inspect a…
Troubleshooting
LightingService.exe High CPU: Fix ASUS Aura and EAC Errors
Learn why LightingService.exe uses high CPU, how to test an ASUS Aura or Easy…
Troubleshooting
NahimicSvc64.exe High CPU: Safe Fix for Nahimic Service
Learn what NahimicSvc64.exe does, why it can use high CPU or crash games, how…
Troubleshooting
GameInputSvc.exe High CPU or Memory: Safe Fixes
Learn why GameInputSvc.exe uses high CPU or memory, how to repair Microsoft GameInput safely,…
Troubleshooting
CefSharp.BrowserSubprocess.exe: Safe Process, Errors, and Multiple Copies
Learn what CefSharp.BrowserSubprocess.exe does, why multiple copies run, how to find the parent app,…
Tips & Tricks
Is Pre-Activated Adobe Acrobat Safe? crack.exe Risks
Found crack.exe in a pre-activated Adobe Acrobat package? Learn what the alert means, what…
Troubleshooting
WiiUDownloader Virus Alert: Is Wacatac.B!ml a False Positive?
Defender flagged WiiUDownloader as Wacatac.B!ml? Learn what the app is, check the download source,…
Troubleshooting
FreeCodecPack Removal: Pop-Ups and Bundled Apps
Remove FreeCodecPack on Windows 10/11, clean bundled apps and browser changes, and check startup…
Security News
Gunra Ransomware Targets Windows and Linux, CISA Warns
A joint CISA/FBI advisory details Gunra ransomware, Windows .ENCRT and Linux .GNRA files, VPN…
Troubleshooting
Is Xunlei Thunder Safe? PUP Alerts and Removal
Learn when Xunlei Thunder is legitimate or unwanted, how to verify its source and…
Tips & Tricks
Is Bright VPN Safe? Bundled Installs, Alerts, and Removal
Bright VPN can be a legitimate app or an unwanted bundled install. Learn how…