Threat research notebook
Fresh malware notes, phishing samples, scam redirects, ransomware observations, and field reports from Gridinsoft research. No gallery, no filler: date, case, finding, next read.
302 lab recordsSnapeDex.com claims to be a cryptocurrency exchange offering free Bitcoin, but there are significant concerns about its legitimacy. However, this site is designed to scam users, particularly with its promise of 0.31 BTC for...
The FBI Denver Field Office has warned about a growing scam involving free online file converter...
Microsoft Defender found HackTool:Win64/GameHack!rfn? Learn if it is a virus or false positive, when not to...
$34.6 million in cryptocurrency could be at risk from StilachiRAT, a complex remote access trojan first...
Can a JPG, PNG, WebP, or SVG hide malware? Learn how steganography attacks work, when images are risky, and what to do after opening...
Cybersecurity researchers have found MassJacker, a new, previously undocumented malware. It targets a predominantly freebie-seeking audience, i.e. users of pirated content. MassJacker Malware Targets...
Trojan:Win64/RustyStealer.DSK!MTB is a sophisticated malware designed to infiltrate 64-bit Windows systems, primarily focusing on stealing sensitive information such as login credentials, financial data, and...
TrojanProxy:Win32/Acapaladat.B is a type of malware that hides in free, unauthorized VPN applications, turning infected computers into proxy servers for cybercriminals. This allows attackers...
Remove OneStart.ai/OneStart Browser, check onestart.exe startup leftovers, user-profile folders, co-installed PUPs, and scan after reboot.
Should you remove EpiBrowser? You should remove EpiBrowser or EpiStart if it appeared without clear consent, replaced your default browser, redirected searches, or came...
The release of DeepSeek AI chatbot gave a push for an enormous number of DeepSeek scams that trick users in a variety of shady...
Windows Defender Security Center scam pop-ups imitate Microsoft alerts and push fake support calls. Learn how to close the page, remove notification spam, and...
Jupiter Airdrop scam is an alleged crypto-airdrop campaign that promises free crypto tokens, yet in return only empties users’ crypto wallets. Parasiting on the...
Sync.clearnview.com alerts usually point to a browser redirect, notification, extension, or adware issue. Learn the safe cleanup order.
AlrustiqApp.exe, also shown as Alrustiq Service, can indicate a miner-like unwanted app. Learn what to check in Task Manager, Services, Startup Apps, and how...
Nnice ransomware is a malware strain that aims at encrypting user files and demanding ransom payment for their decryption. Detected on January 14, 2025,...
Unsecapp.exe is usually a safe Windows WMI process. Learn the correct System32 wbem path, warning signs of fake copies, high CPU checks, and cleanup...
Contacto virus is a newly identified ransomware strain that encrypts victims’ files and demands a ransom for their decryption. We identified this sample on...
Defender found Trojan:JS/FakeUpdate.HNAP!MTB? Learn when it is a browser or OBS cache alert, when it is real FakeUpdates malware, and how to clean it...
RDPLocker is a virus that encrypts the files and demands for a ransom payment for their decryption. It was first detected on malware analysis...
