Fake Calendly Interviews Steal Facebook and Google Logins
Fake Meta Careers booking pages relay Facebook codes and Google approvals. Learn where the interview flow changes into an account takeover.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
FBI Seizes Microscan and FishHub Domains Behind File-Theft Operations
FBI seizures expose how Microscan hid scans behind infected devices and FishHub delivered file-stealing malware. Blocking domains does…
Fake Offline Maps Lead Android Users to a Telegram App Trap
Cyberpolice warns that free navigator ads lead through Telegram to a malicious app. Check installation access and separate…
Guides
View all
Cronigame.exe: Discord Game-Test Scam Warning
Received cronigame.exe from a Discord friend? See what the report establishes and what to do if you downloaded, blocked, or ran the…
Repair desk
View all
TrojanDownloader:Win64/Penguish.PO!MTB: Alerts and Removal
Penguish.PO!MTB keeps returning? Check new alerts versus old history, verify the installer source, and remove threats without unsafe folder deletions.
Trojan:Win32/Sabsik.EN.B!ml: Removal and False Positive Checks
Understand the exact Sabsik EN.B Defender alert, keep suspicious files quarantined, and use Gridinsoft Anti-Malware to investigate repeat detections.
Trojan:MSIL/Jalapeno!MTB: Removal and False-Positive Checks
Check Trojan:MSIL/Jalapeno!MTB by its file path and quarantine status. Separate browser-cache alerts from an installer that…
Domain Age of Flagged Online Stores: A Study of 1,000 Records
Gridinsoft studied 1,000 flagged store records. Compare domain ages for new records and updates, with date…
How Malware Abused Paste.tc: XWorm, LimeRAT, and AsyncRAT Cases
A cross-case investigation of how AsyncRAT, LimeRAT, and XWorm used Paste.tc raw pages as C2 resolvers…
Plushiefun.xyz PowerShell Chain Found Under HP Task Identities
Gridinsoft Labs observed plushiefun.xyz on nine endpoints where activity under Hewlett-Packard Diagnostics task identities led into…
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it,…
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Latest from every desk
Security News
MATCHBOIL Hides a Backdoor Behind a Fake Planner
ESET traces MATCHBOIL’s fake planner, hidden execution mode and two-minute callbacks in Ukraine. Why…
Security News
Noir Wallet Drainer Uses DNS to Keep Fake Crypto Pages Working
Infoblox traces Noir’s wallet-permission trap and DNS backend rotation. Why connecting, signing and disconnecting…
Security News
Fake Event Invitations Turn QR Codes Into Google Phishing
Talos traces real event details, altered poster QR codes and a live Google sign-in…
Security News
NEBULA: Fake AI SDKs Install a Hidden Windows RAT
CloudSEK links seven fake npm AI SDKs to a Windows RAT. The install hook,…
Security News
BlueKit Phishing: A Stolen Session Can Outlast the Login
New BlueKit research tracks subscription phishing tools. Its remote-browser technique explains why account recovery…
Security News
Fake Invoice PDFs Install Action1 Remote-Access Agent
SANS traced fake payment and DHL PDFs to scripts that display a decoy document…
Security News
ASOS Customer Profiles Stolen After Employee Impersonation
BBC finds shopping searches and detailed customer profiles in stolen ASOS data. The company…
Security News
Blinder Tunnel: Fake Dubai Airports Job Test Runs Malware on Project Open
Unit 42 traced a fake Dubai Airports job test that ran malware when a…
Security News
Fake Police Calls Demand Money to “Free” Relatives, Ukraine Warns
Ukraine’s Cyberpolice warns about fake police calls demanding transfers or cash for relatives. Personal…
Security News
Ukraine Money-Mule Network Allegedly Bypassed Bank Blocks
Ukraine police describe about 300 money mules and alleged insider help bypassing card blocks.…
Security News
ShinyHunters Suspect Rey Reportedly Detained in Jordan
Reuters reports a ShinyHunters suspect is helping investigators. The reported detention does not establish…
Troubleshooting
SecurityHealthHost.exe: Is It Safe, and Should You Update It?
Find out what SecurityHealthHost.exe is, when to scan a suspicious copy, and how to…