What Is Proxyjacking? Stolen Bandwidth, Symptoms, and Removal
Proxyjacking turns your device, router, or home IP into a hidden residential proxy. Learn the signs, first checks, removal steps, and how to stop bandwidth abuse.
Threat research notebook
Gridinsoft Security Lab
Fresh malware notes, phishing samples, scam redirects, ransomware observations, and field reports from Gridinsoft research. No gallery, no filler: date, case, finding, next read.
309 lab recordsFake Windows Key Scam
Seeing "Windows Key Code Is Not Valid And Seems Pirated"? It is a fake tech support...
Business Email Compromise (BEC): Signs, Examples, and What to Do
Business email compromise (BEC) abuses trusted email conversations to steal money or data. Learn warning signs,...
New MDBotnet Malware Rapidly Expands a DDoS Network
MDBotnet is a new malware strain that appears to be a backbone of a botnet, used...
Research log
GoDaddy Refund Phishing Emails Spread Infostealer
Hackers started using GoDaddy Refund Emails as a disguise to trick the users into installing malware. In order to deploy the payload, they opted...
Ducktail Infostealer Malware Targeting Facebook Business Accounts
Researchers discovered Ducktail Malware, which targets individuals and organizations on the Facebook Business/Ads platform. The malware steals browser cookies and uses authenticated Facebook sessions...
RedLine Stealer Issues 100,000 Samples – What is Happening?
Throughout the entire early May 2023, GridinSoft analysts team observed an anomalous activity of RedLine stealer. It is, actually, an activity different from what...
Fake Windows Update in Browser Deliver Aurora Stealer
Fake Windows Update became a malware spreading way once again. Updates are a pretty routine part of the Windows user experience. Over the last...
LOBSHOT malware steals cryptowallets, exploits Google Ads
LOBSHOT, a recently-detected malware family, appears to be a new strong player in the malware market. Carrying a combination of backdoor and spyware functionality,...
Domino Backdoor is Lead by FIN7 and Conti Actors
A new Domino Backdoor popped out at the beginning of 2023. Since February, a new malware family coined Domino is used for attack on...
Rorschach Ransomware Analysis
Recent research from the CheckPoint Research team revealed a new ransomware sample that can potentially beat all samples currently present on the market. They...
BlackGuard Receives Update, Targets More Cryptowallets
BlackGuard, a prolific infostealer malware, received an update at the edge of 2023. The new update introduced advanced data-stealing capabilities and secure connectivity features....
Black Friday Scams: Ways to Detect & Avoid Shopping Frauds
As the main shopping event of the year approaches, Black Friday shopping scams have into view. Con actors from all over the world try...
TLS vs HTTPS: Difference, Handshake, and What the Lock Means
TLS and HTTPS are related, but they are not the same thing. TLS is the encryption protocol that protects data in transit. HTTPS is...
Spyware vs Stalkerware: Key Differences and What to Do
Spyware and stalkerware both monitor devices, but the threat model is different. Learn the key difference, warning signs, and safer next steps.
Why Phishing is Still the Most Common Cyber Attack?
Unfortunately, millions of users worldwide are at risk every single day. Statistics show that a successful phishing attack occurs every 30 seconds, suggesting cybercriminals...
Social Engineering Attacks: Types, Examples, and Protection
Social engineering is any attack that manipulates a person into doing something unsafe. The attacker may want a password, MFA code, payment, file download,...
Fargo Ransomware aims at vulnerable Microsoft SQL servers
Ransomware rarely chooses the sole type of targets for their attacks. They roam from attacks on small coffee shops to strikes on governmental organisations,...
Reverse Proxy vs Proxy
What is a Reverse Proxy? A reverse proxy is the same server but is in front of a web server. Depending on its configuration,...
How to Report a False Positive Antivirus Detection Safely
If Microsoft Defender or Gridinsoft flags a file you believe is clean, do not simply allow it and move on. A safe false-positive report...