XCSSET v40 Turns Xcode Projects Into a macOS Supply-Chain Trap
XCSSET v40 runs through trojanized Xcode projects and adds fileless persistence, browser theft, and defense evasion. Learn the build trigger, exposure boundary, and safe recovery steps.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
Operation BlueDash Uses Fake Teams Updates for Remote Access
Operation BlueDash turns a secure-document email into a fake Teams update that installs Level RMM and ScreenConnect. Check…
CVE-2026-16812 Exploited in VeloCloud Orchestrator
Arista confirms active exploitation of CVE-2026-16812 in VeloCloud Orchestrator On-Prem. Check affected releases, observed IPs, log clues, and…
Guides
View all
Astrolonova Invoice Scam: What to Do About the EUR299 Bill
Received an unexpected Astrolonova or Margot Brands invoice? Verify the contract, dispute the claim, protect payments, and handle court mail safely.
Repair desk
View all
Chrome LevelDB Malware Detection: Meaning and Safe Cleanup
Antivirus found malware in a Chrome LevelDB .ldb or .log file? Learn what it means, why alerts return, and how to clean…
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it, restore search, and check persistence.
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Why Antivirus Flags Old Bookmarks and URL Shortcuts
Old Favorites and .url shortcuts can be flagged when saved sites become phishing, scam, or adware…
SF Express E-Invoice HTML Phishing Kit: Technical Analysis
A technical analysis of an SF Express e-invoice HTML attachment that steals email passwords through Telegram…
Runechat.com Scam: RuneScape Casino Phishing Warning
Runechat.com is flagged as phishing with a 3/100 trust score. Learn why not to log in,…
Echo.ac Malware? Echo Anti-Cheat and echo_driver.sys Safety Check
Is Echo.ac malware? Learn when Echo Anti-Cheat is legitimate, why echo_driver.sys needs verification, and what to…
SocGholish Malware: Fake Update Removal Guide
SocGholish, also called FakeUpdates, uses fake browser update prompts on compromised sites. Learn what to do…
Latest from every desk
Tips & Tricks
Is Putlocker Safe in 2026? Clones, Pop-Ups, and Cleanup
Is Putlocker safe? Learn how to identify clone risks, remove pop-ups and notifications, and…
Troubleshooting
AdobeIPCBroker.exe: Safe Adobe Process or Malware Copy?
AdobeIPCBroker.exe is usually a legitimate Creative Cloud process. Verify its path and signature, fix…
Tips & Tricks
Can ISO Files Contain Viruses? Mount and Check Safely
Yes, an ISO can contain malware. Learn what mounting does, how to inspect and…
Tips & Tricks
Is GoMovies Safe in 2026? Clones, Redirects, and Cleanup
Learn how to judge a GoMovies-branded site, spot fake players and redirects, remove notifications,…
Troubleshooting
This App Has Been Blocked for Your Protection: What to Do
See why Windows blocked an app, check its publisher and signature, and choose a…
Troubleshooting
SpeedBit Video Accelerator Removal: Fix DAP and SBLSP.dll
Remove SpeedBit Video Accelerator and DAP safely. Stop leftover services, handle SBLSP.dll without breaking…
Troubleshooting
Controlled Folder Access Blocked an App: Allow or Block?
Controlled Folder Access blocked an app? Verify the file path and signer, decide whether…
Troubleshooting
Are BAT, CMD, VBS, JS, WSF, and PS1 Files Safe?
BAT, VBS, JS, WSF, and PS1 files can run dangerous commands. Learn how to…
Tips & Tricks
Is Flixtor Safe in 2026? VIP, Apps, and Clone Risks
Flixtor names appear on different sites and apps. Learn how to judge VIP payments,…
Troubleshooting
CrashStealer Mac Malware Removal and Account Recovery
Ran Werkbit or a fake CrashReporter on Mac? Remove CrashStealer persistence, protect passwords and…
Troubleshooting
CoreSync.exe: Safe Adobe Process, High CPU, or Malware Copy?
CoreSync.exe is usually Adobe Content Synchronizer. Learn how to verify the path and signature,…
Tips & Tricks
Is Soap2Day Safe in 2026? Fake Clones and Malware Risks
The original Soap2Day closed in 2023. Learn how to judge current clones and respond…