Gridinsoft security desk
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
Dysphoria has grown to roughly 200,000 IoT bots and now uses blockchain-resolved command servers plus compromised relay nodes. Check routers, cameras, UPnP mappings, firmware, and remote-access settings.
SourTrade fake TradingView, Solana and Luno pages assemble unique Windows malware in the browser. Here is how the…
mrmustard 0.7.4 was a malicious PyPI release that stole developer credentials and left cron, shell, and Python persistence.…
StudentDealHub.com rotated from a $500 LEGO reward to a $750 JD Sports offer. Learn how to remove notifications, stop redirects, scan for…
LMS.exe is usually Intel Local Manageability Service. Check its path, signature, AMT role, high CPU, errors, and suspicious copies safely.
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it, restore search, and check persistence.
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Old Favorites and .url shortcuts can be flagged when saved sites become phishing, scam, or adware…
A technical analysis of an SF Express e-invoice HTML attachment that steals email passwords through Telegram…
Runechat.com is flagged as phishing with a 3/100 trust score. Learn why not to log in,…
Is Echo.ac malware? Learn when Echo Anti-Cheat is legitimate, why echo_driver.sys needs verification, and what to…
SocGholish, also called FakeUpdates, uses fake browser update prompts on compromised sites. Learn what to do…
Troubleshooting
Ran Werkbit or a fake CrashReporter on Mac? Remove CrashStealer persistence, protect passwords and…
Troubleshooting
CoreSync.exe is usually Adobe Content Synchronizer. Learn how to verify the path and signature,…
Tips & Tricks
Yes, an MSI can install malware. Check its source, signature, hash, contents, and scan…
Tips & Tricks
HDToday-branded pages are not a verified safe service. Learn how to respond after redirects,…
Tips & Tricks
A CRA Benefit Statement email that opens a third-party Webmail login is phishing. Verify…
Troubleshooting
Polyglow.cc is too risky to trust with funds, wallet approvals, credentials, or ID until…
Troubleshooting
One GRouter86.exe hash is a clean, signed Qihoo 360 helper. Verify your copy's path,…
Troubleshooting
A Bulsis.net redirect alone does not prove infection. Use the exposure checklist to decide…
Troubleshooting
The official PlayStation PC SDK Runtime is legitimate. Verify its source and signature, fix…
Troubleshooting
WPS Office is legitimate by default. Verify its source and signature, interpret antivirus warnings,…
Tips & Tricks
If your account was hacked, secure email first, sign out sessions, remove unknown recovery…
Security News
ReliaQuest found compromised hotel and conference Wi-Fi gateways redirecting travelers to fake Microsoft 365…
