Pixel Modem Flaw: Check the September 5 Security Patch
Google warns of targeted exploitation of a Pixel modem flaw. Check the Android security update date, install the official update, and restart.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
Homebrew 7 Adds Built-In Checks: Read the Skipped Packages
Homebrew 7 adds built-in vulnerability checks for Mac and Linux. Learn what skipped packages mean and where tap…
Windows 11 KB5129195 Fixes RDP, but Audio Code 10 Remains
KB5129195 fixes Remote Desktop and multichannel USB audio on Windows 11 24H2 and 25H2. Code 10 and no-output…
Guides
View all
SimpleSwap Bonus Script Scam: Remove Malicious Userscripts
Remove a fake SimpleSwap bonus userscript, check browser persistence, and respond safely if a crypto address changed or you already sent funds.
Repair desk
View all
Music.exe: Is It a Virus? Check and Remove It Safely
Found Music.exe in Task Manager, startup, or on a USB drive? Identify the file, keep threats quarantined, and check why it returns…
Instant System Health Boost Pop-Up: Find Its Source and Stop It
Behavior:Win32/MaleficAms: Why the Alert Returns After a Clean Scan
ParaRouter128.exe Keeps Appearing at Startup: Check and Remove It
Tsyndicate.com Redirects: Stop Unwanted Tabs and Check the Cause
Securewalle.com Pop-Ups: Stop Fake Scans and Recurring Alerts
Trojan:MSIL/Jalapeno!MTB: Removal and False-Positive Checks
Check Trojan:MSIL/Jalapeno!MTB by its file path and quarantine status. Separate browser-cache alerts from an installer that ran, then verify cleanup.
Domain Age of Flagged Online Stores: A Study of 1,000 Records
Gridinsoft studied 1,000 flagged store records. Compare domain ages for new records and updates, with date…
How Malware Abused Paste.tc: XWorm, LimeRAT, and AsyncRAT Cases
A cross-case investigation of how AsyncRAT, LimeRAT, and XWorm used Paste.tc raw pages as C2 resolvers…
Plushiefun.xyz PowerShell Chain Found Under HP Task Identities
Gridinsoft Labs observed plushiefun.xyz on nine endpoints where activity under Hewlett-Packard Diagnostics task identities led into…
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it,…
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Why Antivirus Flags Old Bookmarks and URL Shortcuts
Old Favorites and .url shortcuts can be flagged when saved sites become phishing, scam, or adware…
Latest from every desk
Troubleshooting
A_Navi.exe System Error: Fix the MAXKERNL.dll Startup Message Safely
A_Navi.exe reports that MAXKERNL.dll is missing? Identify the file and startup source, check for…
Troubleshooting
BlueSuite.exe at Startup: Is It Safe and How Do You Remove It?
BlueSuite.exe appears after a suspicious download? Check its path, signature and startup entry, distinguish…
Security News
Cisco Email Gateway Attacks Turn a Message Into Root Access
Cisco confirms attacks on its email gateway. Check fixed AsyncOS releases and why cloud…
Security News
Revolut Handed Customer Data to a Fake Government Request
Revolut disclosed customer records after a request from a real government email domain. Why…
Security News
Florida Data Breach Traced to Police Login on a Personal Device
Florida traced a government data breach to one police employee’s credentials on a personal…
Security News
ScreenConnect Enters KEV: Update Every Remote-Support Client
CISA lists CVE-2026-84869 as exploited. Check ScreenConnect 26.6.5, host clients, access agents and suspicious…
Security News
Liquid Reopens BTC Deposits While Peg-Outs Stay Closed
SideSwap reopened BTC deposits on September 11 while Liquid peg-outs remain disabled. How unbacked…
Security News
Carnival’s Real Booking Email Led to Malware Through an Expired Domain
A genuine Carnival booking email led to deceptive downloads through a lapsed domain. A…
Security News
StyleSmuggler: Magento Hotfix Expands, Backdoors Still Need Removal
Adobe expands StyleSmuggler hotfix support. See how a failed-payment email leads to a server…
Security News
AI Access Thief Sends 43 KB of Agent Context to a Honeypot
An attacker’s coding agent exposed instructions, keys and history to a research honeypot. How…
Security News
LG TV Privacy: What the Company Says and What to Check
LG disputes TV listening claims. Check optional agreements and voice settings, and understand why…
Security News
Gigabud Uses Vwork to Clone Banking Apps on Android
Gigabud uses Vwork and Android work profiles to separate banking apps from malware. Learn…