NeedyMantis Hides Its Next Stage Behind Familiar DLL Names
Microsoft traces NeedyMantis through planted DLLs, an extensionless archive and a fake PowerShell filename. Here is what the evidence does—and does not—show.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
Storm-3168 Azure Attack: What Failed, What Survived
Microsoft’s Storm-3168 case shows why failed deletion requests, application permissions and separate data protections matter after a cloud…
Introducing Gridinsoft Web Protection for Android
Gridinsoft’s new Android app helps block known phishing and scam websites with one-tap control. Try it free for…
Guides
View all
UMBRA Ransomware: Identify .umbra Files and Plan Recovery
Identify UMBRA ransomware signs, preserve encrypted files, remove remaining threats, and choose realistic recovery options without risking your only copies.
Repair desk
View all
Trojan:PowerShell/Boxter!MTB: Remove It and Check Repeat Alerts
Check a Trojan:PowerShell/Boxter!MTB alert, remove detected threats, and distinguish new PowerShell activity from old Defender history before restoring files.
Trojan:MSIL/Jalapeno!MTB: Removal and False-Positive Checks
Check Trojan:MSIL/Jalapeno!MTB by its file path and quarantine status. Separate browser-cache alerts from an installer that ran, then verify cleanup.
Domain Age of Flagged Online Stores: A Study of 1,000 Records
Gridinsoft studied 1,000 flagged store records. Compare domain ages for new records and updates, with date…
How Malware Abused Paste.tc: XWorm, LimeRAT, and AsyncRAT Cases
A cross-case investigation of how AsyncRAT, LimeRAT, and XWorm used Paste.tc raw pages as C2 resolvers…
Plushiefun.xyz PowerShell Chain Found Under HP Task Identities
Gridinsoft Labs observed plushiefun.xyz on nine endpoints where activity under Hewlett-Packard Diagnostics task identities led into…
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it,…
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Why Antivirus Flags Old Bookmarks and URL Shortcuts
Old Favorites and .url shortcuts can be flagged when saved sites become phishing, scam, or adware…
Latest from every desk
Security News
OnePlus App-to-Root Chain: Researcher Confirms a OnePlus 15 Fix
An installed app crossed two privileged services. Check the confirmed OnePlus 15 fix and…
Security News
Coinbase Impersonator Stole $16M Through “Safe” Wallets
A new sentence exposes how fake Coinbase support moved victims’ crypto into wallets the…
Security News
Kothamine Carries Hostile Commands Through a Legitimate Tunnel
Kothamine uses tailcat for encrypted remote control. The research shows why localhost traffic and…
Security News
Example Domains in Developer Docs Lead to ClickFix and Scams
Manifold found a Windows ClickFix lure and intermittent Mac scams behind familiar example domains.…
Security News
MAX Audit Finds Server Controls That Differ Between Accounts
InterSecLab traced per-account settings, VPN blocking and contact uploads in MAX for Android. The…
Security News
RemotePanel and BoundSiphon Split a ClickFix Attack in Two
A ClickFix command installs persistent RemotePanel access and the BoundSiphon stealer. Why device cleanup…
Security News
Bitget Reports $351.6 Million Wallet Incident, Pauses Withdrawals
Bitget reports unauthorized wallet transfers and pauses withdrawals. What its notice confirms, what remains…
Security News
Storm-2570 Uses Four Ransomware Brands—and the Same Access Tools
Microsoft links Storm-2570 to four ransomware families. Repeated remote access, credential theft and cloud…
Security News
Claude Max Giveaway Fakes a Google Window to Steal Logins
A fake Claude Max gift draws its own Google sign-in window. See the browser…
Security News
HeyCyan Smart Glasses Test Exposes an Open Photo Album
Check the app, firmware and access controls before trusting smart glasses with private recordings.…
Security News
Macfinger Turns Real Websites Into Fake Mac Verification Traps
SANS tracks Macfinger ClickFix on compromised websites. Learn why a fake browser check is…
Security News
CLOSEDQUORUM: Windows Malware Puts Its Next Move to a Vote
Talos found a Windows implant designed to take votes from four AI providers. The…