PeckBirdy Hides Malware Control Behind Casino Websites
Infoblox traced casino decoys to a hidden PeckBirdy control channel. The script evidence, fake-update history and why DNS queries do not prove infection.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
Florida Data Breach Traced to Police Login on a Personal Device
Florida traced a government data breach to one police employee’s credentials on a personal device. Here is what…
ScreenConnect Enters KEV: Update Every Remote-Support Client
CISA lists CVE-2026-84869 as exploited. Check ScreenConnect 26.6.5, host clients, access agents and suspicious file-execution events.
Guides
View all
SimpleSwap Bonus Script Scam: Remove Malicious Userscripts
Remove a fake SimpleSwap bonus userscript, check browser persistence, and respond safely if a crypto address changed or you already sent funds.
Repair desk
View all
Music.exe: Is It a Virus? Check and Remove It Safely
Found Music.exe in Task Manager, startup, or on a USB drive? Identify the file, keep threats quarantined, and check why it returns…
Instant System Health Boost Pop-Up: Find Its Source and Stop It
Behavior:Win32/MaleficAms: Why the Alert Returns After a Clean Scan
ParaRouter128.exe Keeps Appearing at Startup: Check and Remove It
Tsyndicate.com Redirects: Stop Unwanted Tabs and Check the Cause
Securewalle.com Pop-Ups: Stop Fake Scans and Recurring Alerts
Trojan:MSIL/Jalapeno!MTB: Removal and False-Positive Checks
Check Trojan:MSIL/Jalapeno!MTB by its file path and quarantine status. Separate browser-cache alerts from an installer that ran, then verify cleanup.
Domain Age of Flagged Online Stores: A Study of 1,000 Records
Gridinsoft studied 1,000 flagged store records. Compare domain ages for new records and updates, with date…
How Malware Abused Paste.tc: XWorm, LimeRAT, and AsyncRAT Cases
A cross-case investigation of how AsyncRAT, LimeRAT, and XWorm used Paste.tc raw pages as C2 resolvers…
Plushiefun.xyz PowerShell Chain Found Under HP Task Identities
Gridinsoft Labs observed plushiefun.xyz on nine endpoints where activity under Hewlett-Packard Diagnostics task identities led into…
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it,…
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Why Antivirus Flags Old Bookmarks and URL Shortcuts
Old Favorites and .url shortcuts can be flagged when saved sites become phishing, scam, or adware…
Latest from every desk
Troubleshooting
A_Navi.exe System Error: Fix the MAXKERNL.dll Startup Message Safely
A_Navi.exe reports that MAXKERNL.dll is missing? Identify the file and startup source, check for…
Troubleshooting
BlueSuite.exe at Startup: Is It Safe and How Do You Remove It?
BlueSuite.exe appears after a suspicious download? Check its path, signature and startup entry, distinguish…
Security News
Liquid Reopens BTC Deposits While Peg-Outs Stay Closed
SideSwap reopened BTC deposits on September 11 while Liquid peg-outs remain disabled. How unbacked…
Security News
Carnival’s Real Booking Email Led to Malware Through an Expired Domain
A genuine Carnival booking email led to deceptive downloads through a lapsed domain. A…
Security News
StyleSmuggler: Magento Hotfix Expands, Backdoors Still Need Removal
Adobe expands StyleSmuggler hotfix support. See how a failed-payment email leads to a server…
Security News
AI Access Thief Sends 43 KB of Agent Context to a Honeypot
An attacker’s coding agent exposed instructions, keys and history to a research honeypot. How…
Security News
LG TV Privacy: What the Company Says and What to Check
LG disputes TV listening claims. Check optional agreements and voice settings, and understand why…
Security News
Gigabud Uses Vwork to Clone Banking Apps on Android
Gigabud uses Vwork and Android work profiles to separate banking apps from malware. Learn…
Troubleshooting
SnakeBiteAgent RAT: Remove Remote Access and Secure Accounts
Check SnakeBiteAgent RAT exposure, remove unauthorized remote access, scan Windows, and secure accounts after…
Troubleshooting
MBAMService.exe High Memory or Disk: Check the Trend
Check why MBAMService.exe uses RAM or disk, distinguish scanning from persistent idle growth, and…
Security News
Google Play Early Access: Cash Rewards Without Reviews
Deceptive reward apps can hide behind private Early Access feedback. Check the developer, payout…
Troubleshooting
atkexComSvc.exe Errors and High CPU: Repair the ASUS Utility
Check atkexComSvc.exe errors or high CPU, identify the ASUS utility behind it, and repair…