Threat research notebook
Fresh malware notes, phishing samples, scam redirects, ransomware observations, and field reports from Gridinsoft research. No gallery, no filler: date, case, finding, next read.
302 lab recordsDragon Angel is a browser extension that functions as a hijacker malware. It redirects users to promoted search engines or websites. These redirects ruin the process of browsing and can lead to irrelevant or...
Trojan:Script/Sabsik.FL.A!ml is a Defender script Trojan alert. Check the file path, source, false-positive risk, and cleanup...
Backdoor:Win32/Bladabindi!ml is a Defender alert for Bladabindi/njRAT. Learn what to do if it appears in Recycle...
PUA:Win32/PCMechanic is a detection associated with the potentially unwanted application. This pseudo system optimizer claims that...
Trojan:Script/Ulthar.A!ml is a Defender script alert. Check the file path, source, false-positive risk, and cleanup steps before restoring it.
Bitfiat is a malicious coin miner that exploits your computer's hardware to mine cryptocurrencies. Such malware takes as much resources as it can, making...
Trojan:Script/Phonzy.A!ml and B!ml are Microsoft Defender script detections. Check the affected path, archive source, false-positive signs, and safe cleanup steps.
SYSDF is a ransomware-type program that belongs to the Dharma malware family. Such malicious software aims mainly at small companies, aiming at file encryption...
Vmmem or VmmemWSL high memory usually points to WSL2, Docker, Hyper-V, Windows Sandbox, or an emulator. Learn how to stop it safely, set .wslconfig...
Fake ChatGPT apps now include polished desktop-download scams such as openew.app, Chat_GPT.exe, and ChatGpt.dmg. Learn what to check and how to clean up safely.
A new Windows malware called Ov3r_Stealer is spreading through fake Facebook job ads, according to a report by Trustwave SpiderLabs. The malware is designed...
Tax season has already begun, and so did tax season scams. The IRS annually lists its top tax scams to help taxpayers protect themselves....
Recent research uncovers a new sample of Mispadu malware that uses a SmartScreen bypass flaw to integrate itself into the system. This banking trojan...
CrackedCantil is a unique dropper malware sample that operates with a wide variety of malware families. Infecting with one may effectively mean up to...
A bootkit is malware that starts before Windows. Learn the symptoms, DiskPart clean all limits, MBR/UEFI cleanup steps, and safe protection tips.
Learn how TikTok Shop scams work in 2026: fake sellers, off-app checkout, phishing links, counterfeit products, refund traps, and what to do after paying.
Learn 13 common types of malware, how viruses, worms, Trojans, ransomware, spyware, adware, rootkits, loaders, and stealers work, and what to do first.
Learn how DLL search order hijacking works, why malicious DLLs load inside trusted Windows processes, and what to check, detect, and harden.
Defender flagged PUABundler:Win32/PiriformBundler from a CCleaner/Piriform installer? Remove the bundle, keep only clean apps, and scan leftovers.
The threat landscape meets a new player - Rugmi Loader. This threat specializes in spreading spyware, and is in fact capable of delivering any...
