Yoba Fake AI Installers Hide a Miner Behind Signed Apps
Check Point traced Yoba from fake ChatGPT and Claude downloads to signed-app DLL sideloading, a boot task and an XMRig miner. What to check if you ran it.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
Aokigahara Stealer Targets AI Sessions and Developer Keys
Aokigahara collects local AI sessions, Git and cloud credentials. What the October 23 research proves, and what to…
Meta’s $25B Privacy Penalty Exposes Facebook’s Broken Promises
A New Mexico judgment details Facebook’s app-access exceptions, limited data audits and deletion promises. What the $25 billion…
Guides
View all
Coffin Locker Ransomware: Preserve Keys and Recover .coffin Files
Coffin Locker adds .coffin to files. Learn what to preserve before cleanup, why local key files matter, and how to assess safe…
Repair desk
View all
Malware in Windows.old: What an Antivirus Detection Means
Found malware in Windows.old after reinstalling? Check the alert, scan the current system, save needed files, and remove the old installation safely.
Trojan:Win32/Sabsik.EN.B!ml: Removal and False Positive Checks
Understand the exact Sabsik EN.B Defender alert, keep suspicious files quarantined, and use Gridinsoft Anti-Malware to investigate repeat detections.
Trojan:MSIL/Jalapeno!MTB: Removal and False-Positive Checks
Check Trojan:MSIL/Jalapeno!MTB by its file path and quarantine status. Separate browser-cache alerts from an installer that…
Domain Age of Flagged Online Stores: A Study of 1,000 Records
Gridinsoft studied 1,000 flagged store records. Compare domain ages for new records and updates, with date…
How Malware Abused Paste.tc: XWorm, LimeRAT, and AsyncRAT Cases
A cross-case investigation of how AsyncRAT, LimeRAT, and XWorm used Paste.tc raw pages as C2 resolvers…
Plushiefun.xyz PowerShell Chain Found Under HP Task Identities
Gridinsoft Labs observed plushiefun.xyz on nine endpoints where activity under Hewlett-Packard Diagnostics task identities led into…
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it,…
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Latest from every desk
Troubleshooting
Lock Icon on a Drive in Windows 11: Is It a Virus?
Understand the Windows drive padlock, check BitLocker or Device Encryption, and find the right…
Troubleshooting
AgtaBackup RAT Removal: Hidden Service and Watchdog Tasks
Identify AgtaBackup RAT artifacts, understand recurring watchdog tasks, and choose safe Windows cleanup, account…
Security News
Tracebit Context Bombs Send AI Attackers Into Dead Ends
Tracebit tested deceptive documents and fake services against AI attackers. The AWS experiment shows…
Security News
BUGSTER Used AI to Steal Thousands of University Records
Unit 42 links BUGSTER to a university database theft. The evidence separates confirmed stolen…
Troubleshooting
Smart App Control Blocked an App: Check It Safely
Smart App Control blocked an app or one component? Check the warning, source and…
Troubleshooting
EXE Files Open in Notepad: Restore App Launching Safely
EXE files opening in Notepad or asking you to choose an app? Identify a…
Security News
FlashHole: Lazarus Turned Security Software Into a Way In
Lazarus used tailored portfolio sites, CrossWeb EX and in-memory malware in FlashHole. What the…
Security News
PHP2Shell Attacks: Update the Runtime Behind Your Website
PHP has patched two critical flaws as Cloudflare observes attack attempts. Check the fixed…
Security News
Fake Amazon Music Deal Targets YouTube Creators
A fake Amazon Music portal uses real YouTube statistics to sell a false sponsorship,…
Security News
eMudhra Keys Compromised: Browsers Block Forged HTTPS
Google and Mozilla blocked compromised eMudhra CA keys. Why app trust stores still matter,…
Security News
Cairn AI Attacks: Open Panels Exposed Webshells and Secrets
NorForge found exposed Cairn attack dashboards, checked real webshells and uncovered secrets. Task totals…
Security News
OVHcloud CLI Release Swap: A Saved Hash Caught the Malware
OVHcloud CLI files were swapped under old version labels on October 19. A pinned…