Example Domains in Developer Docs Lead to ClickFix and Scams
Manifold found a Windows ClickFix lure and intermittent Mac scams behind familiar example domains. The code references are not proof of compromised repositories.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
Macfinger Turns Real Websites Into Fake Mac Verification Traps
SANS tracks Macfinger ClickFix on compromised websites. Learn why a fake browser check is different from running its…
CLOSEDQUORUM: Windows Malware Puts Its Next Move to a Vote
Talos found a Windows implant designed to take votes from four AI providers. The public sample is inert,…
Guides
View all
UMBRA Ransomware: Identify .umbra Files and Plan Recovery
Identify UMBRA ransomware signs, preserve encrypted files, remove remaining threats, and choose realistic recovery options without risking your only copies.
Repair desk
View all
Trojan:PowerShell/Boxter!MTB: Remove It and Check Repeat Alerts
Check a Trojan:PowerShell/Boxter!MTB alert, remove detected threats, and distinguish new PowerShell activity from old Defender history before restoring files.
Trojan:MSIL/Jalapeno!MTB: Removal and False-Positive Checks
Check Trojan:MSIL/Jalapeno!MTB by its file path and quarantine status. Separate browser-cache alerts from an installer that ran, then verify cleanup.
Domain Age of Flagged Online Stores: A Study of 1,000 Records
Gridinsoft studied 1,000 flagged store records. Compare domain ages for new records and updates, with date…
How Malware Abused Paste.tc: XWorm, LimeRAT, and AsyncRAT Cases
A cross-case investigation of how AsyncRAT, LimeRAT, and XWorm used Paste.tc raw pages as C2 resolvers…
Plushiefun.xyz PowerShell Chain Found Under HP Task Identities
Gridinsoft Labs observed plushiefun.xyz on nine endpoints where activity under Hewlett-Packard Diagnostics task identities led into…
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it,…
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Why Antivirus Flags Old Bookmarks and URL Shortcuts
Old Favorites and .url shortcuts can be flagged when saved sites become phishing, scam, or adware…
Latest from every desk
Security News
Fake Drawing Votes Target Telegram Accounts, Ukraine Warns
A fake drawing contest turns a vote into a Telegram login. Ukraine renewed the…
Security News
AWS Quarantined a Leaked Key in 10 Seconds. The Response Wasn’t Over.
Unit 42 measured AWS quarantining a public GitHub key leak in 10 seconds. See…
Security News
Talking Tilly: The Camera Keeps Analysing After the Age Check
Talking Tilly requires an age selfie, analyses mood during calls and keeps different records…
Security News
Fake AI Subscription Sites Use Real Google Sign-In
Researchers linked over 100 subscription sites using genuine Google login. Learn why authentication does…
Security News
PAYLOAD Turns Windows Group Policy Into a Ransom Demand
PAYLOAD attackers used domain policy to display ransom notes without encrypting Windows files. The…
Security News
Crypto Investment Fraud: $655,000 Case Leads to Prague Search
Ukraine’s cyberpolice says a passive-income pitch sent over $655,000 to suspect-controlled crypto wallets. A…
Security News
Three Exploited Linux Kernel Flaws: Check Your Patch Track
CISA lists three exploited Linux kernel flaws. Check the exact Ubuntu kernel track, pending…
Security News
AgentCore Harness Test Exposes a Service Token Through Memory
Unit 42 demonstrated AgentCore credential theft through a support ticket. See why runtime memory,…
Security News
WaterPlum Fake Job Interviews Infect 30,000 Devices
A joint advisory links WaterPlum fake interviews to 30,000 infected devices. How coding tasks,…
Security News
LeakySensey Rents Out Hacked Routers as a Proxy Network
LeakySensey turned weak VPN logins into rented proxies. What the exposed server revealed, what…
Security News
Settra Ransomware Leaves a Defender Log Intact After a Typo
Huntress found that Settra misspelled a Defender event-log name. What survived, how MeshAgent was…
Security News
The Gentlemen Turn Stolen Backups Into a Source of Credentials
Talos traced backup images being opened for credential extraction and cloud transfer. Why recovery…