Threat research notebook
Fresh malware notes, phishing samples, scam redirects, ransomware observations, and field reports from Gridinsoft research. No gallery, no filler: date, case, finding, next read.
307 lab recordsThe *Arma dei Carabinieri* message is a banner that may appear on your PC, attempting to mimic notifications from Italy's national gendarmerie. Cybercriminals use their name and authority to convince users from Italy into...
PUABundler:Win32/MediaGet is a Microsoft Defender detection for MediaGet-related bundled software. MediaGet is commonly associated with torrent/pirated-content...
PrimeLookup is a Chrome extension that may unexpectedly appear among your browser's add-ons, causing your search...
ZoomFind is a Chrome extension that may unexpectedly appear among the others, causing the browser to...
The SwiftSeek is a browser extension that may unexpectedly appear among the others, causing the browser to redirect your search queries. It belongs to...
Trojan:Script/Obfuse!MSR is a generic detection of a malicious script that abuses command interpreters to execute commands or binaries. What distinguishes this threat from others...
Hkbsse.exe is a name of a process related to Amadey Dropper, that you can observe while browsing through the system. This malware delivers other...
Defender found Trojan:Win32/Stealer!MTB or Steanoz.Z!MTB? Keep it quarantined, check if it ran, protect accounts, and scan leftovers.
Trojan:Win32/Commandrob.A!ml is a heuristic detection associated with suspicious network activity. It may refer to a wide range of malicious programs, or be a false...
Azurestaticapps.net is a selection of pages registered on genuine Microsoft hosting, that try scaring the user by false malware infection claims. In fact, it...
Trojan:Win64/Zusy.CZ!MTB is a detection of Microsoft Defender that can flag several different types of malware. Being a heuristic detection, it can as well be...
Sec-tl pop-up ads are malicious push notifications that parasite legitimate browser functionality. Fraudulent actors that stand behind this chain of websites earn money by...
Defender found Trojan:Win32/LsassDump.A? Learn when the LSASS alert may be false positive, when credentials are at risk, and how to clean leftovers with Gridinsoft.
First-tl pop-up ads are malicious push notifications (like a Sec-tl sites) that parasite legitimate browser functionality. Fraudulent actors that stand behind this chain of...
Defender flagged PUABundler:Win32/Rostpay? Learn what it means, why DriverHub or Tesla Browser bundles trigger it, and how to remove leftovers safely.
Altisik Service using high CPU? Learn what AltisikService.exe is, why it returns after ending the task, what files to check, and how to remove...
What does Fauppod!ml mean? Trojan:Win32/Fauppod!ml is a Microsoft Defender machine-learning detection. It does not name one exact malware family; it means the file looks...
JsTimer is a malicious browser extension detected in various browsers, predominantly targeting users through dubious websites. This extension engages in peculiar behavior by blocking...
Defender found PUA:Win32/GameHack? Use the affected file path to decide false positive vs risky cheat loader, remove it, and fix alerts that return.
Funny Tool Redirect is a malicious browser extension that you may see installed in your browser. It spreads through dodgy websites and does a...
