XCPE Backdoor Came Built Into 1.3 Million TV Boxes
Google disrupted XCPE, a firmware backdoor in TV boxes. Its hidden reinstall mechanism explains why a server takedown is not proof of device cleanup.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
Polymarket Script Hijack Drained Wallets; Refund Plan Reaches $3.9M
Polymarket says a compromised monitoring script abused active sessions. Its October 30 update separates stolen funds from trading-pause…
Searchjacked: Hidden Chrome Extensions Put a Proxy Between You and Search
Socket traces 319 extensions across a decade. See how a simple search setting routes queries through a proxy,…
Guides
View all
Coffin Locker Ransomware: Preserve Keys and Recover .coffin Files
Coffin Locker adds .coffin to files. Learn what to preserve before cleanup, why local key files matter, and how to assess safe…
Repair desk
View all
DmClient.exe: Check a Windows Feedback or Firewall Alert
Saw dmclient.exe in a firewall or antivirus alert? Match the file, signer and scheduled task before allowing a connection or removing a…
Dell TechHub UserProcess.exe Error: What to Check Before Repair
VBCSCompiler.exe: High CPU, Safe Shutdown, or Suspicious Copy?
Malware in Windows.old: What an Antivirus Detection Means
Cross Device Service High Memory or CPU: Isolate the Trigger
ShellHost.exe System Error: What to Check Before Repair
Trojan:Win32/Sabsik.EN.B!ml: Removal and False Positive Checks
Understand the exact Sabsik EN.B Defender alert, keep suspicious files quarantined, and use Gridinsoft Anti-Malware to investigate repeat detections.
Trojan:MSIL/Jalapeno!MTB: Removal and False-Positive Checks
Check Trojan:MSIL/Jalapeno!MTB by its file path and quarantine status. Separate browser-cache alerts from an installer that…
Domain Age of Flagged Online Stores: A Study of 1,000 Records
Gridinsoft studied 1,000 flagged store records. Compare domain ages for new records and updates, with date…
How Malware Abused Paste.tc: XWorm, LimeRAT, and AsyncRAT Cases
A cross-case investigation of how AsyncRAT, LimeRAT, and XWorm used Paste.tc raw pages as C2 resolvers…
Plushiefun.xyz PowerShell Chain Found Under HP Task Identities
Gridinsoft Labs observed plushiefun.xyz on nine endpoints where activity under Hewlett-Packard Diagnostics task identities led into…
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it,…
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Latest from every desk
Security News
VOLTA Stealer Asks AI to Rank Victims Using Stolen Receipts and Sessions
Talos finds VOLTA turning stolen sessions and receipts into an AI-ranked dossier. What its…
Security News
Claude Code in Cursor Planted an SSH Backdoor That Outlives Uninstall
Tampered Claude Code builds in Cursor’s marketplace planted SSH keys and startup scripts. Check…
Security News
Binance Hack: $6.3B Theft Exposes Questions About Signing Access
Binance says losses will be covered after a $6.3 billion theft. Investigators trace signing…
Security News
Synology NAS Ransomware Locks Files as Sources Disagree on Entry
Synology warns of ransomware on outdated DSM. A 360 report identifies C3RB3R, but cites…
Security News
QuickBooks Phishing Uses Callback Traps and Invisible Tracking
Infoblox traced more than 350 QuickBooks-lookalike domains to callback phishing. A hidden pixel identifies…
Security News
Fake Cloudflare Check Sends Windows and Mac Users to Run Commands
A fresh ClickFix lure uses Run on Windows and Terminal on Mac. SANS captured…
Security News
Keystone Stolen Key Could Let Fake Wallets Pass Verification
Keystone will destroy 18,835 unsold wallets after its device-check key was stolen. Why a…
Security News
Fake 6,500 UAH Aid Offers Led to Bank-Account Theft
Ukrainian police describe how a fake aid offer collected card secrets and bank codes.…
Security News
Yoba Fake AI Installers Hide a Miner Behind Signed Apps
Check Point traced Yoba from fake ChatGPT and Claude downloads to signed-app DLL sideloading,…
Security News
ZloyRAT Hides in a Fake Android Fuel Map and Radar
F6 traced ZloyRAT droppers behind fuel-map, radar and VPN lures. Learn why a normal…
Security News
Casino Pages Hid Under School and Government Domains
Infoblox traces two DNS abuse operations that put casino pages under real institutional domains…
Security News
Fake Crypto Profits Hid a $36.9M Money Trail, DOJ Says
Zheng Zhao’s extradition brings a fresh court step in a crypto-fraud case. DOJ describes…