Fake Invoice PDFs Install Action1 Remote-Access Agent
SANS traced fake payment and DHL PDFs to scripts that display a decoy document while installing Action1. Check what ran before treating the agent as malware.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
BPFDoor and AVERAT Hide Linux Access in Mail-Gateway Traffic
Rapid7 found Linux implants using deleted executables, daemon disguises and SMTP control traffic. What mail-gateway operators should investigate.
iCloud Sender Spoofing Passed Email Authentication in Newly Disclosed Research
New iCloud research explains how forged sender addresses passed SPF, DKIM and DMARC. The flaws were fixed in…
Guides
View all
Cronigame.exe: Discord Game-Test Scam Warning
Received cronigame.exe from a Discord friend? See what the report establishes and what to do if you downloaded, blocked, or ran the…
Repair desk
View all
Windows Event Log High CPU: Find What Keeps Writing Events
Trace Windows Event Log high CPU or disk usage to the event source or querying tool, preserve useful evidence, and verify a…
SecurityHealthHost.exe: Is It Safe, and Should You Update It?
How to Remove Hp-quicker.com Redirects from Your Browser
Background Intelligent Transfer Service High CPU: Find the BITS Job
DCOM Server Process Launcher High CPU: Trace the Trigger
Service Host Local System High CPU: Find the Busy Service
Trojan:Win32/Sabsik.EN.B!ml: Removal and False Positive Checks
Understand the exact Sabsik EN.B Defender alert, keep suspicious files quarantined, and use Gridinsoft Anti-Malware to investigate repeat detections.
Trojan:MSIL/Jalapeno!MTB: Removal and False-Positive Checks
Check Trojan:MSIL/Jalapeno!MTB by its file path and quarantine status. Separate browser-cache alerts from an installer that…
Domain Age of Flagged Online Stores: A Study of 1,000 Records
Gridinsoft studied 1,000 flagged store records. Compare domain ages for new records and updates, with date…
How Malware Abused Paste.tc: XWorm, LimeRAT, and AsyncRAT Cases
A cross-case investigation of how AsyncRAT, LimeRAT, and XWorm used Paste.tc raw pages as C2 resolvers…
Plushiefun.xyz PowerShell Chain Found Under HP Task Identities
Gridinsoft Labs observed plushiefun.xyz on nine endpoints where activity under Hewlett-Packard Diagnostics task identities led into…
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it,…
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Latest from every desk
Security News
MetaMask Staking Exits Validators After Reward Payments Were Diverted
MetaMask is exiting affected validators after diverted rewards. The 0.36 ETH payment total and…
Security News
Free Mobile Phishing Turns a €9.99 Bill Into a Card-Data Trap
A documented Free Mobile phishing email uses a €9.99 debt and a disguised link…
Security News
Fake xStocks and Pendle Votes Lure Users to Wallet Permissions
A new investigation finds 70 fake crypto sites. Their reward vote opens a wallet…
Security News
RedFlick Turns a Phishing Invitation Into Scheduled Windows Tasks
Microsoft traces Star Blizzard’s RedFlick chain: document-looking shortcuts, remote applets and scheduled tasks delivering…
Security News
Car Apps Share VINs and Location: What a New Privacy Study Actually Found
Northeastern tested 21 cars and 30 apps. Seven apps sent personal identifiers to trackers;…
Troubleshooting
Crypto Address Changes When You Paste It? Check for Clipboard Malware
Crypto address changes when pasted? Separate normal wallet rotation from clipboard malware, check the…
Troubleshooting
MicrosoftEdgeUpdate.exe Keeps Crashing? Check Updates Before Disabling It
MicrosoftEdgeUpdate.exe keeps crashing or retrying? Verify Edge updates, check the file, repair safely, and…
Troubleshooting
Windows Defender Remediation Incomplete: Is the Threat Still Active?
Diagnose Defender’s Remediation incomplete warning by comparing the affected file, detection time, scan results,…
Troubleshooting
Browser Closes When Searching for Antivirus? What to Do
Browser closes when you search for antivirus, or installers disappear? Scan Windows with Gridinsoft…
Security News
Poper Blocker Collects AI Chats Through Rules Delivered After Installation
Researchers found Poper Blocker collecting browser history and AI chats. The case shows how…
Security News
MSP360 Phishing Turns One Fake Invitation Into Two Remote-Access Channels
Microsoft traced fake invitations and PDF lures to MSP360, then ScreenConnect. Why UAC mattered…
Security News
iPhone Duo Preorder Trap Starts a DarkSword Attack Before You Submit
A fake iPhone Duo offer loads DarkSword before the form is submitted. What the…