Claude Code Auto Mode: Check What an Approved Command Can Reach
A controlled Opus 5 test turned a website summary into code execution. Review imports, sandbox limits and child processes without treating a small sample as a universal rate.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
Packagist iPhone Spyware: Check iOS and the Website Theme
Malicious Packagist themes target older iPhones through streaming sites. Separate phone updates, account exposure and cleanup of deployed…
Manchester Airport Breach: Verify Parking Payment Requests
MAG bookings remain valid after its data breach. Verify parking payments, refunds and calls independently, even when they…
Guides
View all
Windows 11 Debloat Tools: Safety, Rollback, and Security Trade-Offs
Choose Windows 11 debloat and customization tools by what they change, which protections they affect, and how you can return to a…
Repair desk
View all
LogiOptionsMgr.exe Crashes: Restore Your Mouse Buttons
Fix LogiOptionsMgr.exe crashes without losing mouse settings. Identify Options versus Options+, check file identity, and choose the right recovery steps.
How Malware Abused Paste.tc: XWorm, LimeRAT, and AsyncRAT Cases
A cross-case investigation of how AsyncRAT, LimeRAT, and XWorm used Paste.tc raw pages as C2 resolvers or PowerShell stages, with behavioral hunts and careful attribution boundaries.
Plushiefun.xyz PowerShell Chain Found Under HP Task Identities
Gridinsoft Labs observed plushiefun.xyz on nine endpoints where activity under Hewlett-Packard Diagnostics task identities led into…
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it,…
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Why Antivirus Flags Old Bookmarks and URL Shortcuts
Old Favorites and .url shortcuts can be flagged when saved sites become phishing, scam, or adware…
SF Express E-Invoice HTML Phishing Kit: Technical Analysis
A technical analysis of an SF Express e-invoice HTML attachment that steals email passwords through Telegram…
Runechat.com Scam: RuneScape Casino Phishing Warning
Runechat.com is flagged as phishing with a 3/100 trust score. Learn why not to log in,…
Latest from every desk
Security News
ReliaQuest Phishing: MFA Approved, Application Access Blocked
ReliaQuest says device trust blocked applications after a password and MFA approval were phished.…
Security News
inpoutx64 Game Crashes: Restart, Block or Ask IT?
Windows 11 inpoutx64 crashes need game-specific action. Check the ARC Raiders block, THE FINALS…
Security News
Ransom Busters Recovery Scam: What to Do After Contact
Ransom Busters offers paid help during ransomware incidents. Verify the sender, preserve evidence, and…
Security News
RedC2 npm Packages: Importing Can Infect a Linux Host
RedC2 starts a Linux backdoor when a poisoned npm package is imported. Check package…
Security News
MikroTrick RouterOS Attacks: Patch and Check Your Router
MikroTrick attacks chain two RouterOS flaws against routers with public SSH. Check fixed versions,…
Security News
REVSTEALER Malware: What to Do After It Runs
REVSTEALER steals browser, gaming, and wallet data, then may delete itself. Learn how to…
Security News
GEEKOM Driver Malware: Check the Legacy LAN Package
GEEKOM removed a malware-flagged installer from old LAN driver archives. Check the exact file…
Security News
Google Calendar Phishing: Fake DocuSign Leads to Remote Access
A real Google Calendar invite can hide a fake DocuSign viewer. Learn what to…
Security News
Fake Car Dealership Websites: Verify Before You Pay
Fake dealership websites copy real brands, vehicles, and reviews. Verify the dealer, VIN, inspection,…
Security News
GOG-Games Shuts Down After 8 Years
GOG-Games.to has closed after eight years. Read the farewell, its warning about donations to…
Security News
MyChart Phishing Scam Uses Fake Results and Medicare Kits
Fake MyChart messages use lab results or a Medicare kit to steal logins, run…
Security News
Fake Apple Pay Charge: Do Not Call the Number
A fake Apple Pay page can show Face ID and speak a charge warning…