Falcon C2 Uses a Fake PDF Viewer to Spy Through the Browser
Unit 42 traces Falcon C2 from compromised webmail to a fake PDF extension. How the browser became an authenticated proxy and a window into internal documents.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
Ukraine Sends UAH 700,000 Telegram Dating-Bot Fraud Case to Court
Ukraine’s Cyber Police say a Telegram dating-bot introduction led to a request for an Odesa student’s bank login…
How Ransomware Reached ESXi and Proxmox With Stolen Root Credentials
Two investigations show how root credentials from PRTG monitoring and a workstation let attackers encrypt ESXi and Proxmox…
Guides
View all
Frontier Airlines Refund Email Scam: How to Verify Your Booking
Check a Frontier refund or unpaid-booking email against your real trip and payment history. See what to do if you clicked or…
Repair desk
View all
How to Remove the PDF2Docs.com Redirect from Your Browser
Stop searches from going through pdf2docs.com. Check the extension and search provider in Chrome, Edge or Firefox, then test whether the redirect…
Trojan:Win32/Sabsik.EN.B!ml: Removal and False Positive Checks
Understand the exact Sabsik EN.B Defender alert, keep suspicious files quarantined, and use Gridinsoft Anti-Malware to investigate repeat detections.
Trojan:MSIL/Jalapeno!MTB: Removal and False-Positive Checks
Check Trojan:MSIL/Jalapeno!MTB by its file path and quarantine status. Separate browser-cache alerts from an installer that…
Domain Age of Flagged Online Stores: A Study of 1,000 Records
Gridinsoft studied 1,000 flagged store records. Compare domain ages for new records and updates, with date…
How Malware Abused Paste.tc: XWorm, LimeRAT, and AsyncRAT Cases
A cross-case investigation of how AsyncRAT, LimeRAT, and XWorm used Paste.tc raw pages as C2 resolvers…
Plushiefun.xyz PowerShell Chain Found Under HP Task Identities
Gridinsoft Labs observed plushiefun.xyz on nine endpoints where activity under Hewlett-Packard Diagnostics task identities led into…
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it,…
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Latest from every desk
Troubleshooting
CC_Engine_x64.exe High CPU: Diagnose MSI Center Safely
CC_Engine_x64.exe using high CPU? Verify the MSI file, isolate monitoring triggers, separate WMI load…
Troubleshooting
Blazer Virus Pop-Ups: Stop Alerts and Remove Blazer Browser
Stop Blazer virus pop-ups by checking the notification sender, blocking unwanted sites, and removing…
Troubleshooting
Modern Setup Host High CPU: Check Progress Before Stopping It
Modern Setup Host using high CPU? Check update progress, SetupDiag logs and the real…
Troubleshooting
Trojan:Win32/Rimecud!pz: What to Do After a USB Alert
Defender flagged Trojan:Win32/Rimecud!pz on a USB drive? Understand Removed status, check the PC and…
Security News
AI CEO Impersonation Alleged in $129M Wire Fraud Case
U.S. prosecutors say an NDA request, an AI-imitated executive and a fake lawyer steered…
Security News
Operation Trade: Fake Brokers Cost 135 German Victims €4.3M
Ukraine’s Cyber Police says fake brokers guided victims from exchange purchases to accounts the…
Security News
ChatGPT Lockdown Mode Bypass Through HTML Previews Was Fixed
Check Point showed how an HTML preview escaped ChatGPT Lockdown Mode. OpenAI fixed the…
Security News
NIKKE Launcher Cleanup Can Erase Compromise Evidence
NIKKE players should save launcher logs before cleanup. Independent research separates evidence of agent…
Security News
Microsoft: Email Exceptions Let Detected Spoofing Through
Microsoft’s Q3 report shows how mail exceptions overrode detection. The 63% figure concerns tracked…
Troubleshooting
PDM:Trojan.Win32.Generic: Kaspersky Alert and Removal
Understand Kaspersky’s PDM:Trojan.Win32.Generic alert, choose the right disinfection option, investigate false positives, and handle…
Security News
ARTEX AI Agents Steal App-Signing Certificates
Check Point traced ARTEX agents stealing 300+ app-signing certificates. Only three passed validation, while…
Security News
Haiou Turns a Codex Greeting Into a Gateway Ad
Check Point traced persistent gateway ads to Haiou’s global agent instructions. A signed package…