Railway Explains Why New API Keys Were Revoked
Railway says newer API keys entered a precautionary revocation list by mistake. What the October breach exposed and when developers need to rotate again.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
FlashHole: Lazarus Turned Security Software Into a Way In
Lazarus used tailored portfolio sites, CrossWeb EX and in-memory malware in FlashHole. What the investigation establishes—and what remains…
PHP2Shell Attacks: Update the Runtime Behind Your Website
PHP has patched two critical flaws as Cloudflare observes attack attempts. Check the fixed releases, vendor backports and…
Guides
View all
Is FileZilla Safe? Sponsored Installers and Fake Downloads
Distinguish FileZilla sponsored-installer PUA alerts from fake downloads. Check the exact package, review bundled offers and choose the right cleanup steps.
Repair desk
View all
Ome-Relay.exe and ZoneDispa.exe: Removal and File Safety
Ome-Relay.exe in use or ZoneDispa.exe keeps getting blocked? Understand the alerts, scan safely, protect accounts, and preserve PNG files before recovery.
Trojan:Win32/Sabsik.EN.B!ml: Removal and False Positive Checks
Understand the exact Sabsik EN.B Defender alert, keep suspicious files quarantined, and use Gridinsoft Anti-Malware to investigate repeat detections.
Trojan:MSIL/Jalapeno!MTB: Removal and False-Positive Checks
Check Trojan:MSIL/Jalapeno!MTB by its file path and quarantine status. Separate browser-cache alerts from an installer that…
Domain Age of Flagged Online Stores: A Study of 1,000 Records
Gridinsoft studied 1,000 flagged store records. Compare domain ages for new records and updates, with date…
How Malware Abused Paste.tc: XWorm, LimeRAT, and AsyncRAT Cases
A cross-case investigation of how AsyncRAT, LimeRAT, and XWorm used Paste.tc raw pages as C2 resolvers…
Plushiefun.xyz PowerShell Chain Found Under HP Task Identities
Gridinsoft Labs observed plushiefun.xyz on nine endpoints where activity under Hewlett-Packard Diagnostics task identities led into…
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it,…
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Latest from every desk
Security News
Fake Amazon Music Deal Targets YouTube Creators
A fake Amazon Music portal uses real YouTube statistics to sell a false sponsorship,…
Security News
eMudhra Keys Compromised: Browsers Block Forged HTTPS
Google and Mozilla blocked compromised eMudhra CA keys. Why app trust stores still matter,…
Security News
Cairn AI Attacks: Open Panels Exposed Webshells and Secrets
NorForge found exposed Cairn attack dashboards, checked real webshells and uncovered secrets. Task totals…
Security News
OVHcloud CLI Release Swap: A Saved Hash Caught the Malware
OVHcloud CLI files were swapped under old version labels on October 19. A pinned…
Security News
BeyondTrust Closed Real Intrusion Alerts as False Positives
BeyondTrust says automated triage dismissed real intrusion alerts. The ARMORY CASTLE case shows why…
Security News
ConnectWise Backup Access Planted New Keys in Microsoft 365
The ConnectWise/SkyKick incident used application access, not employee logins. See why disabling backups does…
Troubleshooting
Usb Safe Protect.exe: Removal and Hidden USB Files
Check Usb Safe Protect.exe safely, remove detections, recover hidden USB files, and investigate recurring…
Security News
FirstVDS Breach Copied Disks While Customer Servers Kept Running
FirstVDS says attackers copied customer VM disks outside the guest OS. Notified customers need…
Security News
Eiliko Robot Report: Private Chats and Editable Cloud Memory
Eiliko research traced exposed conversations and editable cloud memory. What the October 13 retest…
Security News
PEERSTITCH Hid Inside FortiGate After a Management Breach
Unit 42 traced stolen configurations for 500+ firewalls, reused credentials and a memory implant.…
Troubleshooting
GameAssembly.dll Virus Alert: Check Unity Game DLLs Safely
GameAssembly.dll or lib_burst_generated.dll quarantined? Check the game source and exact alert, keep suspect files…
Security News
AdFection: Targeted Ads Delivered Candiru Spyware Without a Click
Citizen Lab traces Al Jazeera spyware infections through targeted ads, selective code delivery and…