RedFlick Turns a Phishing Invitation Into Scheduled Windows Tasks
Microsoft traces Star Blizzard’s RedFlick chain: document-looking shortcuts, remote applets and scheduled tasks delivering CosmicPulse.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
KB5002907 Paused After Office 2016 and 2019 Lose Activation or Disappear
Microsoft paused KB5002907 after some Office 2016 and 2019 installations lost activation or were removed. Follow the official…
Belnet Email Breach Exposes Messages and Attachments From Outside Senders
Belnet says attackers copied incoming emails and attachments. Check the July–September exposure window and what it means for…
Guides
View all
UMBRA Ransomware: Identify .umbra Files and Plan Recovery
Identify UMBRA ransomware signs, preserve encrypted files, remove remaining threats, and choose realistic recovery options without risking your only copies.
Repair desk
View all
Background Intelligent Transfer Service High CPU: Find the BITS Job
Find the BITS job behind high CPU usage, distinguish downloads from stuck transfers, and recover without permanently disabling Windows update services.
DCOM Server Process Launcher High CPU: Trace the Trigger
Service Host Local System High CPU: Find the Busy Service
smartscreen.exe: Is It Safe, and What If It Crashes?
Crypto Address Changes When You Paste It? Check for Clipboard Malware
MicrosoftEdgeUpdate.exe Keeps Crashing? Check Updates Before Disabling It
Trojan:Win32/Sabsik.EN.B!ml: Removal and False Positive Checks
Understand the exact Sabsik EN.B Defender alert, keep suspicious files quarantined, and use Gridinsoft Anti-Malware to investigate repeat detections.
Trojan:MSIL/Jalapeno!MTB: Removal and False-Positive Checks
Check Trojan:MSIL/Jalapeno!MTB by its file path and quarantine status. Separate browser-cache alerts from an installer that…
Domain Age of Flagged Online Stores: A Study of 1,000 Records
Gridinsoft studied 1,000 flagged store records. Compare domain ages for new records and updates, with date…
How Malware Abused Paste.tc: XWorm, LimeRAT, and AsyncRAT Cases
A cross-case investigation of how AsyncRAT, LimeRAT, and XWorm used Paste.tc raw pages as C2 resolvers…
Plushiefun.xyz PowerShell Chain Found Under HP Task Identities
Gridinsoft Labs observed plushiefun.xyz on nine endpoints where activity under Hewlett-Packard Diagnostics task identities led into…
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it,…
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Latest from every desk
Troubleshooting
Browser Closes When Searching for Antivirus? What to Do
Browser closes when you search for antivirus, or installers disappear? Scan Windows with Gridinsoft…
Troubleshooting
Generic ML PUA: Virus, Unwanted App, or False Positive?
Understand the Sophos Generic ML PUA alert, remove unwanted software with Gridinsoft Anti-Malware, and…
Security News
Wagenius Gets 70 Months for Phone-Record Hacking and Extortion
Cameron Wagenius received 70 months for telecom hacking and extortion. The case shows why…
Security News
WordPress Template Flaw Enters KEV as Attacks Reach File Writes
CISA lists the exploited WordPress template flaw. Learn why theme and PHP conditions matter,…
Security News
Kiteworks Calls for a Nine-Hour Pause After Threat Warning
Kiteworks requested a nine-hour shutdown without reporting a breach. Who handles the pause, what…
Security News
Ledger Phishing Ads Turn a Fake Device Check Into a Seed-Phrase Trap
Google ads led Ledger users through cloud redirects to a fake device check. Its…
Security News
Storm-3168 Azure Attack: What Failed, What Survived
Microsoft’s Storm-3168 case shows why failed deletion requests, application permissions and separate data protections…
Security News
OnePlus App-to-Root Chain: Researcher Confirms a OnePlus 15 Fix
An installed app crossed two privileged services. Check the confirmed OnePlus 15 fix and…
Security News
Coinbase Impersonator Stole $16M Through “Safe” Wallets
A new sentence exposes how fake Coinbase support moved victims’ crypto into wallets the…
Security News
Kothamine Carries Hostile Commands Through a Legitimate Tunnel
Kothamine uses tailcat for encrypted remote control. The research shows why localhost traffic and…
Security News
Example Domains in Developer Docs Lead to ClickFix and Scams
Manifold found a Windows ClickFix lure and intermittent Mac scams behind familiar example domains.…
Security News
MAX Audit Finds Server Controls That Differ Between Accounts
InterSecLab traced per-account settings, VPN blocking and contact uploads in MAX for Android. The…