BUGSTER Used AI to Steal Thousands of University Records
Unit 42 links BUGSTER to a university database theft. The evidence separates confirmed stolen records from AI-generated attack plans and unfinished VoIP fraud.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
BeyondTrust Closed Real Intrusion Alerts as False Positives
BeyondTrust says automated triage dismissed real intrusion alerts. The ARMORY CASTLE case shows why patches, external logs, and…
ConnectWise Backup Access Planted New Keys in Microsoft 365
The ConnectWise/SkyKick incident used application access, not employee logins. See why disabling backups does not remove credentials planted…
Guides
View all
Put Gridinsoft Domain Intelligence to Work in Your Security Stack
Turn domain matches into useful security decisions with Gridinsoft intelligence feeds. Explore product, DNS and SOC integration patterns, local snapshot handling and…
Repair desk
View all
Smart App Control Blocked an App: Check It Safely
Smart App Control blocked an app or one component? Check the warning, source and signature, and understand supported options without a blanket…
Trojan:Win32/Sabsik.EN.B!ml: Removal and False Positive Checks
Understand the exact Sabsik EN.B Defender alert, keep suspicious files quarantined, and use Gridinsoft Anti-Malware to investigate repeat detections.
Trojan:MSIL/Jalapeno!MTB: Removal and False-Positive Checks
Check Trojan:MSIL/Jalapeno!MTB by its file path and quarantine status. Separate browser-cache alerts from an installer that…
Domain Age of Flagged Online Stores: A Study of 1,000 Records
Gridinsoft studied 1,000 flagged store records. Compare domain ages for new records and updates, with date…
How Malware Abused Paste.tc: XWorm, LimeRAT, and AsyncRAT Cases
A cross-case investigation of how AsyncRAT, LimeRAT, and XWorm used Paste.tc raw pages as C2 resolvers…
Plushiefun.xyz PowerShell Chain Found Under HP Task Identities
Gridinsoft Labs observed plushiefun.xyz on nine endpoints where activity under Hewlett-Packard Diagnostics task identities led into…
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it,…
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Latest from every desk
Security News
FirstVDS Breach Copied Disks While Customer Servers Kept Running
FirstVDS says attackers copied customer VM disks outside the guest OS. Notified customers need…
Security News
Eiliko Robot Report: Private Chats and Editable Cloud Memory
Eiliko research traced exposed conversations and editable cloud memory. What the October 13 retest…
Security News
PEERSTITCH Hid Inside FortiGate After a Management Breach
Unit 42 traced stolen configurations for 500+ firewalls, reused credentials and a memory implant.…
Security News
AdFection: Targeted Ads Delivered Candiru Spyware Without a Click
Citizen Lab traces Al Jazeera spyware infections through targeted ads, selective code delivery and…
Mobile Security
Hirudo Android Malware: Removal and Bank App Recovery
Hirudo can replace a banking app with a tampered copy. Learn what to remove,…
Security News
Linux Spies Copied Sudo Passwords Before Running the Real Command
Unit 42 traces AI-assisted Linux espionage through a sudo password trap, PHP persistence and…
Security News
FTC Halts Sextortion Help Firm Over Alleged False Promises
FTC alleges Digital Forensics sold costly sextortion help, fabricated reports and pushed a second…
Security News
Help TDS: Fake Microsoft Support Pushes Remote Access
Infoblox traced Help TDS from a fake Windows lock to an UltraViewer download request.…
Security News
YAM Store Takedown Hits the Wholesale Side of Phishing
Microsoft and partners disrupted YAM Store and phishing-kit suppliers. See how stolen cloud accounts…
Security News
Fake Calendly Interviews Steal Facebook and Google Logins
Fake Meta Careers booking pages relay Facebook codes and Google approvals. Learn where the…
Security News
Xandr Fined Over Grindr Data in Ad Auctions
Norway fined Xandr NOK 92 million over historical Grindr data sharing. How app identity…
Troubleshooting
WindowsPackageManagerServer.exe: Is It Safe, and How Do You Fix an Error?
Check WindowsPackageManagerServer.exe, interpret firewall and signature alerts, and follow the right App Installer update…