Pass-ta-key Attack Lets Malware Hijack Google Passkeys
Unit 42 showed how malware on Chrome for Windows can abuse synced Google passkeys. Learn who is affected, what was fixed, and how to recover safely.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
XCSSET v40 Turns Xcode Projects Into a macOS Supply-Chain Trap
XCSSET v40 runs through trojanized Xcode projects and adds fileless persistence, browser theft, and defense evasion. Learn the…
Copilot Word AI Worm Can Spread Hidden Prompts Between Documents
A Copilot for Word test showed a hidden instruction copying itself into generated documents. Here is the real…
Guides
View all
Astrolonova Invoice Scam: What to Do About the EUR299 Bill
Received an unexpected Astrolonova or Margot Brands invoice? Verify the contract, dispute the claim, protect payments, and handle court mail safely.
Repair desk
View all
Quick Driver Updater Removal: Stop qdu.exe and Leftovers
Remove Quick Driver Updater, qdu.exe, recurring scheduled tasks, and leftovers, then safely recover from unwanted driver changes.
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it, restore search, and check persistence.
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Why Antivirus Flags Old Bookmarks and URL Shortcuts
Old Favorites and .url shortcuts can be flagged when saved sites become phishing, scam, or adware…
SF Express E-Invoice HTML Phishing Kit: Technical Analysis
A technical analysis of an SF Express e-invoice HTML attachment that steals email passwords through Telegram…
Runechat.com Scam: RuneScape Casino Phishing Warning
Runechat.com is flagged as phishing with a 3/100 trust score. Learn why not to log in,…
Echo.ac Malware? Echo Anti-Cheat and echo_driver.sys Safety Check
Is Echo.ac malware? Learn when Echo Anti-Cheat is legitimate, why echo_driver.sys needs verification, and what to…
SocGholish Malware: Fake Update Removal Guide
SocGholish, also called FakeUpdates, uses fake browser update prompts on compromised sites. Learn what to do…
Latest from every desk
Troubleshooting
KillerNetworkService.exe High CPU: Safe Fix and Virus Check
KillerNetworkService.exe can cause sustained CPU, VPN, or wake problems. Learn how to test the…
Troubleshooting
Adobe CEF Helper.exe High CPU: Why Multiple Processes Run
Adobe CEF Helper.exe can legitimately run in multiple copies. Learn how to diagnose sustained…
Troubleshooting
Adobe Desktop Service.exe: High CPU, Safe Stop, and Repair
Adobe Desktop Service.exe is usually legitimate. Learn why it stays active, how to fix…
Troubleshooting
WavesSvc64.exe: MaxxAudio Service or ValleyRAT Malware Copy?
WavesSvc64.exe is usually a Waves MaxxAudio component, but malware can reuse the name. Verify…
Troubleshooting
Chrome LevelDB Malware Detection: Meaning and Safe Cleanup
Antivirus found malware in a Chrome LevelDB .ldb or .log file? Learn what it…
Troubleshooting
NetOneUpdater.exe: Is It Safe? LocalNetSolutions Adware Removal
Check whether NetOneUpdater.exe is safe, remove LocalNetSolutions or LocalNetService adware, fix browser redirects, and…
Troubleshooting
macOS.Gaslight Malware Removal and Account Recovery
macOS.Gaslight is a Rust backdoor and stealer. Check its LaunchAgent and XProtect evidence, remove…
Troubleshooting
SystemTemp Folder Filling Up? Safe Cleanup and Cause Tracing
C:\Windows\SystemTemp is legitimate, but rapid growth can fill the system drive. Recover space safely,…
Troubleshooting
Is AnkerGames Safe? OnlineFix64.dll Alerts and Cleanup
AnkerGames safety depends on the exact domain, download chain, and what ran. Check OnlineFix64.dll…
Security News
SvcHostUpdate.exe in Startup: The MythicalsGames Backdoor
SvcHostUpdate.exe in Windows Startup matches a malicious web3-token-helper chain. Learn what the file proves,…
Security News
Cisco FMC CVE-2026-20316 Exploited: Check and Patch
Cisco says attackers are exploiting a static credential in on-premises Secure FMC. Check for…
Security News
Joyfill npm Packages Compromised: Six Malicious Versions
Six prerelease versions of @joyfill/components and @joyfill/layouts carried an import-time RAT and credential stealer.…