Fake Car Dealership Websites: Verify Before You Pay
Fake dealership websites copy real brands, vehicles, and reviews. Verify the dealer, VIN, inspection, and payment recipient before sending a deposit.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
Sality Botnet Disrupted, but Infected PCs Still Need Cleanup
The Sality botnet lost its command channel, not its existing infections. Verify notices, isolate affected PCs, and decide…
Fake Razer and Edge Downloads Hide Persistent Windows Malware
Fake Razer, Edge and Kaspersky downloads can leave persistent Windows malware. Check whether an installer ran, then review…
Guides
View all
Windows 11 Debloat Tools: Safety, Rollback, and Security Trade-Offs
Choose Windows 11 debloat and customization tools by what they change, which protections they affect, and how you can return to a…
Repair desk
View all
Is AtlasOS Safe? Defender, Updates, and Recovery
Is AtlasOS safe? Compare current and legacy security defaults, verify Defender, updates and Core Isolation, measure gaming gains, and recover safely.
How Malware Abused Paste.tc: XWorm, LimeRAT, and AsyncRAT Cases
A cross-case investigation of how AsyncRAT, LimeRAT, and XWorm used Paste.tc raw pages as C2 resolvers or PowerShell stages, with behavioral hunts and careful attribution boundaries.
Plushiefun.xyz PowerShell Chain Found Under HP Task Identities
Gridinsoft Labs observed plushiefun.xyz on nine endpoints where activity under Hewlett-Packard Diagnostics task identities led into…
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it,…
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Why Antivirus Flags Old Bookmarks and URL Shortcuts
Old Favorites and .url shortcuts can be flagged when saved sites become phishing, scam, or adware…
SF Express E-Invoice HTML Phishing Kit: Technical Analysis
A technical analysis of an SF Express e-invoice HTML attachment that steals email passwords through Telegram…
Runechat.com Scam: RuneScape Casino Phishing Warning
Runechat.com is flagged as phishing with a 3/100 trust score. Learn why not to log in,…
Latest from every desk
Security News
IDScan.net Breach Investigation: What to Do About ID Scans
The FBI is investigating reports of stolen ID scans. What remains unconfirmed, how to…
Security News
Dropbox Lenovo ID Breach: Check Account and File Access
Dropbox says about 5,000 accounts were accessed through Lenovo ID. Check your notice, sessions,…
Security News
Fake Netflix APK Delivers PanDa RAT Through Meta Ads
Fake Netflix and streaming APKs in Meta ads delivered PanDa RAT. Check Android permissions,…
Security News
Fake Exodus Installer Hides a RAT Behind a Wallet That Never Opens
A fake Exodus installer runs the wallet invisibly while a RAT steals browser data…
Security News
iAuthFlow v2 Adds a Rogue Google Passkey That Survives Reset
iAuthFlow v2 can add an attacker-controlled Google passkey after a relayed phishing login. Learn…
Security News
Agent Tesla Malware Hides in Emoji-Obfuscated JScript
A fake SWIFT payment email uses emoji-obfuscated JScript to run Agent Tesla v4 in…
Security News
Superior: 19 Browser Extensions Steal Wallets and Passwords
The Superior campaign weaponized 19 Chrome and Edge extensions to steal crypto, passwords, sessions,…
Security News
SynkLoader Malware Uses a Fake Windows Lock Screen to Steal Passwords
SynkLoader arrives through fake Teams help-desk chats, steals Windows passwords with PhishLocker, and opens…
Troubleshooting
Microsoft.Photos.exe High Memory: Fix Windows Photos
Microsoft.Photos.exe using too much RAM? Verify the Photos process, isolate the trigger, then update,…
Troubleshooting
GameBar.exe Not Opening: Repair, Disable, or Reinstall
GameBar.exe runs but Xbox Game Bar will not open or record? Fix shortcuts, repair…
Troubleshooting
SearchFilterHost.exe High CPU or Crashing: Fix Event 10024
Fix SearchFilterHost.exe high CPU, repeated crashes, and Event 10024 by isolating a bad file…
Troubleshooting
Widgets.exe System Error: Fix Windows 11 Widgets
Fix Widgets.exe system errors, unknown hard errors, blank panels, and missing Windows 11 Widgets…