Threat research notebook
Fresh malware notes, phishing samples, scam redirects, ransomware observations, and field reports from Gridinsoft research. No gallery, no filler: date, case, finding, next read.
305 lab recordsTrojan:PowerShell/CoinStealer.RP!MTB is a detection of Microsoft Defender, that normally flags malware that can steal cryptocurrency wallets. You may see it popping up after downloading a program from the Web or running a dodgy PowerShell...
PUA:Win32/SBYinYing is a potentially unwanted application (PUA) that is often bundled with certain cracked games. It...
Need to disable Windows Defender on Windows 11? Use Windows Security for a short trusted task,...
Trojan:Win32/Qhosts is malware that provides remote access to the target system and modifies the Hosts file....
PUABundler:Win32/YandexBundled is a detection of potentially unwanted application (PUA) associated with the Russian company Yandex. It is typically distributed as bundled software with repackaged...
Attackers are actively exploiting a critical vulnerability in the Docker Engine that may allow for authentication bypass in a chain attack. This vulnerability allows...
Players of Hamster Kombat have become prime targets for scammers promoting phishing schemes aimed at those looking for easy earnings. Malicious actors steal confidential...
Trojan:BAT/PSRunner.VS!MSR is a detection of malware that executes malicious commands on a compromised system. It does not do much hurt by itself and rather...
A new threat has been discovered in the form of a Windows shortcut that is actually a .NET-based shellcode downloader called Jellyfish Loader. It...
Cross-Site Request Forgery Cross-Site Request Forgery (CSRF) is an attack targeting vulnerabilities in computer security, posing significant risks to user information and accounts. It...
Phishing is the trick; spoofing is the disguise. See examples, spoofed-vs-hacked sender checks, AI/QR/caller ID lures, and what to do after a click.
Trojan:Script/Downloader!MSR is a Microsoft Defender alert for a script that can download another payload. Check the source, quarantine status, false-positive signs, and leftover persistence...
Defender found Trojan:Win32/Bearfoos.B!ml or Bearfoos.A!ml? Check false-positive clues, file path risk, leftovers, and safe removal steps.
Polymorphic malware changes its encrypted wrapper; metamorphic malware rewrites its code. Learn the difference, detection signs, examples, and safe removal steps.
Instagram hacking scams is an old-new direction of online fraud that targets people who want to get into someone’s accounts on social media. Frauds...
Stopabit is an unwanted application that has almost no useful functionality. Users can see its promotions as a useful tool for screen time control,...
Weather Zero can run WeatherZeroService.exe, use high CPU, show ads, and leave stubborn files. Learn how to uninstall it, stop the service, and clean...
Bloom.exe is a malicious miner that masquerades as a legitimate process. Its job is to use the victim's device to mine cryptocurrency for con...
Seeing Tnega!MSR, Tnega!ml, or Adware:Win32/Tnega in Defender? Check the path, source, false-positive clues, recurrence, and safe removal steps.
InstallCore is a bundler/PUA detection, not always a classic virus. Check Microsoft and F-Secure context, remove bundled apps, browser changes, and leftovers.
