Threat research notebook
Fresh malware notes, phishing samples, scam redirects, ransomware observations, and field reports from Gridinsoft research. No gallery, no filler: date, case, finding, next read.
305 lab recordsSMApps is a malicious program that aims at spreading illegal promotions. It mainly attacks browsers by changing settings and redirecting search queries from Google to suspicious sites. Possible distribution methods are standard: malicious adverts...
Is uTorrent safe? Learn what the PUABundler:Win32/uTorrent_BundleInstaller alert means and how to remove bundled offers, fake...
WogRAT, also known as WingsOfGod RAT, is a novice remote access trojan that attacks users from...
PUABundler:Win32/FusionCore is a designation that Microsoft Defender Antivirus uses to detect and remove potentially unwanted programs...
Trojan:Script/Sabsik.FL.A!ml is a Defender script Trojan alert. Check the file path, source, false-positive risk, and cleanup steps before restoring it.
Backdoor:Win32/Bladabindi!ml is a Defender alert for Bladabindi/njRAT. Learn what to do if it appears in Recycle Bin, when not to restore it, and how...
PUA:Win32/PCMechanic is a detection associated with the potentially unwanted application. This pseudo system optimizer claims that the user’s system has many problems, and then...
Trojan:Script/Ulthar.A!ml is a Defender script alert. Check the file path, source, false-positive risk, and cleanup steps before restoring it.
Bitfiat is a malicious coin miner that exploits your computer's hardware to mine cryptocurrencies. Such malware takes as much resources as it can, making...
Trojan:Script/Phonzy.A!ml and B!ml are Microsoft Defender script detections. Check the affected path, archive source, false-positive signs, and safe cleanup steps.
SYSDF is a ransomware-type program that belongs to the Dharma malware family. Such malicious software aims mainly at small companies, aiming at file encryption...
Vmmem or VmmemWSL high memory usually points to WSL2, Docker, Hyper-V, Windows Sandbox, or an emulator. Learn how to stop it safely, set .wslconfig...
Fake ChatGPT apps now include polished desktop-download scams such as openew.app, Chat_GPT.exe, and ChatGpt.dmg. Learn what to check and how to clean up safely.
A new Windows malware called Ov3r_Stealer is spreading through fake Facebook job ads, according to a report by Trustwave SpiderLabs. The malware is designed...
Tax season has already begun, and so did tax season scams. The IRS annually lists its top tax scams to help taxpayers protect themselves....
Recent research uncovers a new sample of Mispadu malware that uses a SmartScreen bypass flaw to integrate itself into the system. This banking trojan...
CrackedCantil is a unique dropper malware sample that operates with a wide variety of malware families. Infecting with one may effectively mean up to...
A bootkit is malware that starts before Windows. Learn the symptoms, DiskPart clean all limits, MBR/UEFI cleanup steps, and safe protection tips.
Learn how TikTok Shop scams work in 2026: fake sellers, off-app checkout, phishing links, counterfeit products, refund traps, and what to do after paying.
Learn 13 common types of malware, how viruses, worms, Trojans, ransomware, spyware, adware, rootkits, loaders, and stealers work, and what to do first.
