The Gentlemen Turn Stolen Backups Into a Source of Credentials
Talos traced backup images being opened for credential extraction and cloud transfer. Why recovery tests alone do not establish backup security.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
CHOSEN BRICK: Fake Support Moves Spyware to Personal PCs
A joint warning shows how CHOSEN BRICK operators move targets from work devices to personal Windows PCs, using…
Pixel Modem Flaw: Check the September 5 Security Patch
Google warns of targeted exploitation of a Pixel modem flaw. Check the Android security update date, install the…
Guides
View all
UMBRA Ransomware: Identify .umbra Files and Plan Recovery
Identify UMBRA ransomware signs, preserve encrypted files, remove remaining threats, and choose realistic recovery options without risking your only copies.
Repair desk
View all
PureRAT (win.pure_rat): Removal and Account Recovery
Learn what PureRAT and win.pure_rat mean, how to respond to quarantine or recurring alerts, remove malware, and secure accounts after possible execution.
AvastUI.exe Not Opening? Fix Application Errors Safely
CrossDeviceResume.exe Error: Disable Resume or Repair Windows?
Music.exe: Is It a Virus? Check and Remove It Safely
Instant System Health Boost Pop-Up: Find Its Source and Stop It
Behavior:Win32/MaleficAms: Why the Alert Returns After a Clean Scan
Trojan:MSIL/Jalapeno!MTB: Removal and False-Positive Checks
Check Trojan:MSIL/Jalapeno!MTB by its file path and quarantine status. Separate browser-cache alerts from an installer that ran, then verify cleanup.
Domain Age of Flagged Online Stores: A Study of 1,000 Records
Gridinsoft studied 1,000 flagged store records. Compare domain ages for new records and updates, with date…
How Malware Abused Paste.tc: XWorm, LimeRAT, and AsyncRAT Cases
A cross-case investigation of how AsyncRAT, LimeRAT, and XWorm used Paste.tc raw pages as C2 resolvers…
Plushiefun.xyz PowerShell Chain Found Under HP Task Identities
Gridinsoft Labs observed plushiefun.xyz on nine endpoints where activity under Hewlett-Packard Diagnostics task identities led into…
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it,…
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Why Antivirus Flags Old Bookmarks and URL Shortcuts
Old Favorites and .url shortcuts can be flagged when saved sites become phishing, scam, or adware…
Latest from every desk
Security News
Fake Avast Renewal Page Hid an Unfinished Cancellation Form
A fake €129.99 Avast renewal page asked for contact details, but its form sent…
Security News
Fake macOS Toolkit Setup Leads to AMOS Data Theft
Unit 42 traced a fake macOS toolkit from a pasted Terminal command to password…
Security News
Fake Bank Calls in Mykolaiv Turned “Reserve Accounts” Into Theft
Police in Mykolaiv exposed callers posing as bank security. Their reserve-account pitch turned a…
Security News
PeckBirdy Hides Malware Control Behind Casino Websites
Infoblox traced casino decoys to a hidden PeckBirdy control channel. The script evidence, fake-update…
Security News
Fake Bitrefill Checkouts Turn Search Visits Into Crypto Payments
Fake Bitrefill sites copy a normal checkout, then route cryptocurrency to scammers. Why a…
Troubleshooting
Tsyndicate.com Redirects: Stop Unwanted Tabs and Check the Cause
Stop Tsyndicate.com redirects and unwanted tabs. Check ad blocks, notification permissions, recurring browser changes,…
Troubleshooting
Securewalle.com Pop-Ups: Stop Fake Scans and Recurring Alerts
Stop Securewalle.com pop-ups by finding the notification, extension, startup page or unwanted app behind…
Troubleshooting
CheatEngine75 Removal: Uninstall Cheat Engine and Bundled Apps
Remove CheatEngine75 safely: delete the setup file, uninstall Cheat Engine, check unwanted bundled apps,…
Security News
HBO Max Reddit Ads Led to the PasteSwitch Malware Operation
A hijacked HBO Max Reddit account ran 108 malicious ads. Researchers followed a copied…
Troubleshooting
A_Navi.exe System Error: Fix the MAXKERNL.dll Startup Message Safely
A_Navi.exe reports that MAXKERNL.dll is missing? Identify the file and startup source, check for…
Troubleshooting
BlueSuite.exe at Startup: Is It Safe and How Do You Remove It?
BlueSuite.exe appears after a suspicious download? Check its path, signature and startup entry, distinguish…
Security News
Homebrew 7 Adds Built-In Checks: Read the Skipped Packages
Homebrew 7 adds built-in vulnerability checks for Mac and Linux. Learn what skipped packages…