Threat research notebook
Fresh malware notes, phishing samples, scam redirects, ransomware observations, and field reports from Gridinsoft research. No gallery, no filler: date, case, finding, next read.
310 lab recordsPUA:Win32/MyWebSearch is a Microsoft Defender potentially unwanted application detection tied to browser/search changes. It is usually not a destructive virus, but it can change the browser experience, add unwanted components, or arrive with bundled...
SMApps is a malicious program that aims at spreading illegal promotions. It mainly attacks browsers by...
Hunt ransomware is a new sample of the Dharma/CrySis ransomware family that appeared on April 5,...
Researchers uncovered a vulnerability in Apple Silicon processors, dubbed GoFetch. It allows attackers to extract secret...
Dragon Angel is a browser extension that functions as a hijacker malware. It redirects users to promoted search engines or websites. These redirects ruin...
Taskbarify is unwanted software (like a Movidown)that claims it is a tiny little Windows tweaker. However, it also turns the device into a proxy...
Is uTorrent safe? Learn what the PUABundler:Win32/uTorrent_BundleInstaller alert means and how to remove bundled offers, fake installers, and leftovers.
WogRAT, also known as WingsOfGod RAT, is a novice remote access trojan that attacks users from Asian countries. Named after its own file –...
PUABundler:Win32/FusionCore is a designation that Microsoft Defender Antivirus uses to detect and remove potentially unwanted programs (PUP) that are spread by bundling technology. FusionCore...
Trojan:Script/Sabsik.FL.A!ml is a Defender script Trojan alert. Check the file path, source, false-positive risk, and cleanup steps before restoring it.
Backdoor:Win32/Bladabindi!ml is a Defender alert for Bladabindi/njRAT. Learn what to do if it appears in Recycle Bin, when not to restore it, and how...
PUA:Win32/PCMechanic is a detection associated with the potentially unwanted application. This pseudo system optimizer claims that the user’s system has many problems, and then...
Trojan:Script/Ulthar.A!ml is a Defender script alert. Check the file path, source, false-positive risk, and cleanup steps before restoring it.
Bitfiat is a malicious coin miner that exploits your computer's hardware to mine cryptocurrencies. Such malware takes as much resources as it can, making...
Trojan:Script/Phonzy.A!ml and B!ml are Microsoft Defender family detections. Check the affected path, archive/cache versus execution, false-positive evidence, recurring alerts, and safe cleanup.
SYSDF is a ransomware-type program that belongs to the Dharma malware family. Such malicious software aims mainly at small companies, aiming at file encryption...
Vmmem or VmmemWSL high memory usually points to WSL2, Docker, Hyper-V, Windows Sandbox, or an emulator. Learn how to stop it safely, set .wslconfig...
Fake ChatGPT apps now include polished desktop-download scams such as openew.app, Chat_GPT.exe, and ChatGpt.dmg. Learn what to check and how to clean up safely.
A new Windows malware called Ov3r_Stealer is spreading through fake Facebook job ads, according to a report by Trustwave SpiderLabs. The malware is designed...
Tax season has already begun, and so did tax season scams. The IRS annually lists its top tax scams to help taxpayers protect themselves....
