FBI Disrupts QTFY Router Botnet Behind China-Linked Attacks
The FBI and DOJ disabled QTFY’s QScan and QTRouter platforms. Compromised routers and IoT devices hid attacks on critical infrastructure.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
CVE-2026-60004 Exploited Against Gitea Servers
CISA confirms active exploitation of CVE-2026-60004 in Gitea. Check affected versions, open registration, diffpatch logs, and exposed secrets.
CVE-2026-55553: urllib Redirects Can Leak Credentials
A high-severity Node.js urllib flaw can forward authentication headers on cross-origin redirects. Update to 4.9.1 or 2.44.1 and…
Guides
View all
Is YesMovies Safe? Clone Sites, Redirects, and Cleanup
The YesMovies name does not prove a current domain is safe. Learn how to handle redirects, notifications, downloads, accounts, and card exposure.
Repair desk
View all
ISUSPM.exe: What It Is, Startup Errors, and Safe Removal
ISUSPM.exe is a legacy InstallShield/FlexNet updater helper. Verify its owner, stop startup errors, disable it safely, or remove suspicious copies.
How Malware Abused Paste.tc: XWorm, LimeRAT, and AsyncRAT Cases
A cross-case investigation of how AsyncRAT, LimeRAT, and XWorm used Paste.tc raw pages as C2 resolvers or PowerShell stages, with behavioral hunts and careful attribution boundaries.
Plushiefun.xyz PowerShell Chain Found Under HP Task Identities
Gridinsoft Labs observed plushiefun.xyz on nine endpoints where activity under Hewlett-Packard Diagnostics task identities led into…
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it,…
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Why Antivirus Flags Old Bookmarks and URL Shortcuts
Old Favorites and .url shortcuts can be flagged when saved sites become phishing, scam, or adware…
SF Express E-Invoice HTML Phishing Kit: Technical Analysis
A technical analysis of an SF Express e-invoice HTML attachment that steals email passwords through Telegram…
Runechat.com Scam: RuneScape Casino Phishing Warning
Runechat.com is flagged as phishing with a 3/100 trust score. Learn why not to log in,…
Latest from every desk
Troubleshooting
Atieclxx.exe: Safe AMD Process, Errors, and CPU Fix
Atieclxx.exe is usually an AMD driver helper. Check its path and signature, fix application…
Troubleshooting
ShellExperienceHost.exe High CPU or Memory: Safe Fixes
ShellExperienceHost.exe can spike briefly or crash in a loop. Learn what is normal, check…
Troubleshooting
taskhostw.exe: Safe Process, High CPU, and Shutdown Fixes
taskhostw.exe is a Windows task host. Learn why multiple copies appear, find the task…
Troubleshooting
WUDFHost.exe High CPU: Find the Driver and Fix It
WUDFHost.exe high CPU usually points to a stuck device driver. Find the device, fix…
Troubleshooting
SearchIndexer.exe High CPU or Disk Usage: Safe Fixes
SearchIndexer.exe using high CPU or disk? Check indexing status, narrow locations, repair or rebuild…
Troubleshooting
WorldWideWeb.exe: Is It Safe? Remove the World Wide Web PUP
Found WorldWideWeb.exe under World Wide Solutions? Check its path, signature, task and bundle, then…
Troubleshooting
OneChecker Scheduled Task: Remove Hidden PowerShell Malware
Found a OneChecker task launching hidden PowerShell? Inspect its Action safely, remove the task…
Troubleshooting
Wininit.exe: Safe Process, Virus Check, and Restart Events
Wininit.exe is a critical Windows process. Verify its System32 path and signature, diagnose high…
Troubleshooting
mDNSResponder.exe: Is It Safe? Fix Errors or Remove Bonjour
mDNSResponder.exe is Apple Bonjour on Windows. Verify its path and signature, fix high CPU…
Security News
CVE-2026-21962 Exploited in Oracle HTTP Server Proxy
CISA confirms active exploitation of CVE-2026-21962 in Oracle HTTP Server and the WebLogic Proxy…
Security News
PavinLoader Spreads Through ClickFix and Fake Downloads
PavinLoader links fake CAPTCHA, software, and game lures to a multi-stage Windows malware chain.…
Security News
Grok Cryptographic Context Injection Could Leak Chat History
Adversa AI showed how encrypted webpage instructions could make Grok expose current-chat data. See…