Agent Tesla Malware Hides in Emoji-Obfuscated JScript
A fake SWIFT payment email uses emoji-obfuscated JScript to run Agent Tesla v4 in memory. See the exposure states, containment steps, and finance controls.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
TerminalFix Turns Fake CAPTCHA Into a Network Tunnel
Microsoft says TerminalFix uses a fake CAPTCHA, PowerShell, DLL sideloading, and a reverse tunnel. Check these artifacts if…
FBI Disrupts QTFY Router Botnet Behind China-Linked Attacks
The FBI and DOJ disabled QTFY’s QScan and QTRouter platforms. Compromised routers and IoT devices hid attacks on…
Guides
View all
Is KissCartoon Safe? KimCartoon Clones and Cleanup
Is KissCartoon safe? Learn how to spot unverified KimCartoon clones, stop pop-ups and notifications, protect accounts, and clean downloads.
Repair desk
View all
Is AtlasOS Safe? Defender, Updates, and Recovery
Is AtlasOS safe? Compare current and legacy security defaults, verify Defender, updates and Core Isolation, measure gaming gains, and recover safely.
How Malware Abused Paste.tc: XWorm, LimeRAT, and AsyncRAT Cases
A cross-case investigation of how AsyncRAT, LimeRAT, and XWorm used Paste.tc raw pages as C2 resolvers or PowerShell stages, with behavioral hunts and careful attribution boundaries.
Plushiefun.xyz PowerShell Chain Found Under HP Task Identities
Gridinsoft Labs observed plushiefun.xyz on nine endpoints where activity under Hewlett-Packard Diagnostics task identities led into…
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it,…
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Why Antivirus Flags Old Bookmarks and URL Shortcuts
Old Favorites and .url shortcuts can be flagged when saved sites become phishing, scam, or adware…
SF Express E-Invoice HTML Phishing Kit: Technical Analysis
A technical analysis of an SF Express e-invoice HTML attachment that steals email passwords through Telegram…
Runechat.com Scam: RuneScape Casino Phishing Warning
Runechat.com is flagged as phishing with a 3/100 trust score. Learn why not to log in,…
Latest from every desk
Troubleshooting
Microsoft.Photos.exe High Memory: Fix Windows Photos
Microsoft.Photos.exe using too much RAM? Verify the Photos process, isolate the trigger, then update,…
Troubleshooting
GameBar.exe Not Opening: Repair, Disable, or Reinstall
GameBar.exe runs but Xbox Game Bar will not open or record? Fix shortcuts, repair…
Troubleshooting
SearchFilterHost.exe High CPU or Crashing: Fix Event 10024
Fix SearchFilterHost.exe high CPU, repeated crashes, and Event 10024 by isolating a bad file…
Troubleshooting
Widgets.exe System Error: Fix Windows 11 Widgets
Fix Widgets.exe system errors, unknown hard errors, blank panels, and missing Windows 11 Widgets…
Troubleshooting
SearchProtocolHost.exe Application Error: Fix Crashes and High CPU
Fix SearchProtocolHost.exe application errors, crash loops, unknown hard errors, and high CPU by checking…
Troubleshooting
AvastSvc.exe High CPU or Disk: Safe Fixes for Avast Service
AvastSvc.exe using high CPU, disk, or memory? Check whether Avast is scanning, verify the…
Troubleshooting
Is Winhance Safe? Security Settings and Rollback Risks
Is Winhance safe? Verify the official download, review VBS, Memory Integrity, Smart App Control…
Troubleshooting
Explorer.exe High CPU in Windows 11: Find the Trigger
Explorer.exe using high CPU? Restart it safely, reproduce the trigger, isolate folders or shell…
Troubleshooting
SystemSettings.exe Crash or System Error: Windows 11 Fixes
SystemSettings.exe crashing or flashing closed? Separate normal suspension from errors, check the fault, reset…
Troubleshooting
OneDrive High CPU or Memory: Fix Stuck Sync Safely
OneDrive using high CPU or memory? Prove the sync loop, check folders and Files…
Security News
Klever Fixes 2 Critical KLV Minting Flaws
Klever-Go flaws CVE-2026-54754 and CVE-2026-54755 could create unbacked KLV. One was exploited in June;…
Troubleshooting
ISUSPM.exe: What It Is, Startup Errors, and Safe Removal
ISUSPM.exe is a legacy InstallShield/FlexNet updater helper. Verify its owner, stop startup errors, disable…