NewApp Digest
search bot

Antivirus

Researchers Use Windows Minifilter Drivers to Detect Ransomware in Real Time
Tech Optimizer
February 10, 2026

Researchers Use Windows Minifilter Drivers to Detect Ransomware in Real Time

A security researcher has developed a proof-of-concept tool called Sanctum, available on GitHub, aimed at combating ransomware within the Windows operating system. Sanctum utilizes a Windows feature known as a "filter driver" to monitor file operations at a strategic chokepoint between applications and the hard drive. It employs two primary callbacks: IRPMJCREATE, which detects rapid file write or delete requests indicative of ransomware activity, and IRPMJSET_INFORMATION, which identifies changes in file metadata, such as renaming with malicious extensions. Upon detecting suspicious activity, Sanctum blocks the action and identifies the source of the threat, logging events for security teams. Future enhancements may include real-time encryption detection and the ability to freeze malicious threads. This kernel-level approach offers greater visibility and speed compared to traditional antivirus solutions.
AKDAN Malware Hunters blocks new malware that are difficult to detect with existing Antivirus with 'AKDAN HALL'
Tech Optimizer
February 10, 2026

AKDAN Malware Hunters blocks new malware that are difficult to detect with existing Antivirus with ‘AKDAN HALL’

AKDAN Malware Hunters has launched the AKDAN HALL PED, a security solution that detects and neutralizes unknown document-based malware in 0.27 seconds, achieving a 99% success rate against emerging threats. This technology uses Pre-Execution Detection (PED) and a virtual "hypnosis" environment to analyze potentially malicious behavior, differing from traditional antivirus software that relies on known threat databases. CEO Sean Jeon, with over 15 years in cybersecurity, emphasizes the need for proactive measures as 91% of cyberattacks start via email, often using document-based malware. The AKDAN HALL product line includes a cloud-based agent for personal use and the AKDAN HALL Mini, a compact server for sensitive environments, both designed to complement existing antivirus solutions. The company has received support from the Initial Startup Package program at Seoul National University of Science and Technology and plans to expand into the Japanese market.
GuLoader Leverages Polymorphic Malware and Trusted Cloud Infrastructure to Evade Detection
Tech Optimizer
February 10, 2026

GuLoader Leverages Polymorphic Malware and Trusted Cloud Infrastructure to Evade Detection

GuLoader, also known as CloudEye, is a downloader malware that has been active since late 2019, primarily used to fetch and install secondary malware like Remote Access Trojans (RATs) and information stealers. It employs legitimate cloud services such as Google Drive and Microsoft OneDrive to host its malicious payloads, allowing it to evade detection by security tools. GuLoader utilizes advanced techniques including polymorphic code, which alters its appearance to avoid static detection signatures, and exception-based control flow to confuse analysis tools. Over the years, GuLoader has refined its tactics, including the use of software breakpoints and various exception types to redirect its operations. It also employs dynamic XOR encryption to obfuscate internal data, making it difficult for analysts to extract URLs. The malware's continuous evolution poses ongoing challenges for security researchers. Indicators of Compromise (IOCs) include specific hash values for different versions of GuLoader from 2022 to 2024.
Why Should Small Businesses Invest In Antivirus Protection?
Tech Optimizer
February 10, 2026

Why Should Small Businesses Invest In Antivirus Protection?

53% of UK businesses experience cybercrime attempts at least once a month, and 70% of business owners anticipate a cyber attack in the near future, yet only 35% feel adequately prepared. 43% of cyberattacks are directed at small businesses, with over half potentially closing due to the damage. Antivirus software is a cost-effective solution that can prevent data breaches, reduce the likelihood of ransomware, and protect devices of remote workers.
silver Android smartphone
Tech Optimizer
February 10, 2026

Why Should Small Businesses Invest In Antivirus Protection?

53% of UK businesses experience cybercrime attempts at least once a month. 70% of business owners anticipate a cyber attack in the near future, but only about 35% feel prepared. 43% of cyberattacks are directed at small businesses, and over half of these may face closure due to the damage. Antivirus software can prevent data breaches, is cost-effective, reduces the likelihood of ransomware, and protects devices of remote workers.
When Digital Guardians Turn Rogue: Inside the eScaneS an Antivirus Supply Chain Attack That Exposed Millions
Tech Optimizer
February 1, 2026

When Digital Guardians Turn Rogue: Inside the eScaneS an Antivirus Supply Chain Attack That Exposed Millions

eScan, an antivirus solution, has become a conduit for a supply chain attack that may have affected millions of users through a compromised software update mechanism. The attack exploited eScan’s automatic update system, distributing malware via official channels that appeared legitimate, thus bypassing traditional security measures. Reports indicate that supply chain attacks have increased by over 300% in the past three years, with software update mechanisms being prime targets. The exact number of affected users is still under investigation, but the breach occurred over a limited period before detection. Enterprises using eScan now face vulnerabilities in their security infrastructure, prompting IT departments to conduct forensic analyses to determine if their networks were compromised. The breach raises concerns about digital security as users typically rely on antivirus solutions for protection. Researchers found that the malware used advanced techniques, including multi-stage deployment and polymorphic behavior to evade detection, indicating significant resources behind the attack. In response, eScan has initiated an incident response protocol, revoked compromised digital certificates, and added verification layers to its update system. However, restoring user trust will require transparency about the breach and preventive measures. The incident has led to widespread security audits across the antivirus sector and may accelerate the adoption of zero-trust security models. Regulatory inquiries are underway regarding eScan's data protection practices, and legal experts anticipate class-action lawsuits from affected users and enterprises. The breach highlights a trend where attackers target security infrastructure itself, making software distribution security a critical focus for cybersecurity professionals. Proposed solutions include blockchain-based verification systems and industry-wide standards for supply chain security. The eScan breach underscores that no organization is immune to sophisticated supply chain attacks, as compromising a security vendor can provide access to its entire customer base. Increased information sharing about supply chain threats is advocated to enhance collaboration within the security industry. Moving forward, eScan must balance technical remediation with transparent communication to rebuild trust, while users are advised to implement defense-in-depth strategies rather than relying solely on one security tool.
NordVPN blocks 92% malicious sites in independent phishing test
Tech Optimizer
January 30, 2026

NordVPN blocks 92% malicious sites in independent phishing test

NordVPN successfully blocked 92% of phishing websites in an evaluation by AV-Comparatives, highlighting the effectiveness of its anti-malware tool, Threat Protection Pro. The assessment, conducted from January 7 to January 19, 2026, analyzed 250 phishing URLs, with NordVPN's Threat Protection Pro ranking fourth among tested products. The tool is designed to protect users from various online threats and operates at the network level, scanning traffic directly on the user's device. Threat Protection Pro is available to higher-tier subscribers on the Plus, Complete, and Ultra plans, and is compatible with Windows and macOS. Despite slipping from previous podium finishes, Threat Protection Pro has consistently ranked high in evaluations and was the first VPN service to receive AV-Comparatives' approval for anti-phishing protection in 2024. It also received accolades from AV-TEST and West Coast Labs for its phishing detection capabilities.
Bitdefender vs McAfee
Tech Optimizer
January 30, 2026

Bitdefender vs McAfee

Bitdefender and McAfee are both established antivirus solutions that achieve similar lab test scores, often earning 18 points in assessments by AV-Test and AV-Comparatives. Bitdefender offers a more economical pricing structure, with its Antivirus Plus plan priced between .99 and .99 per year for three devices, while McAfee's plans start at .99 for one device. In real-world malware protection tests, Bitdefender achieved a 99.8% protection rate, compared to McAfee's 99.3%. McAfee includes firewall protection at the antivirus level, while Bitdefender reserves its firewall for higher-tier plans but offers better exploit protection. Bitdefender successfully thwarted 11 out of 12 ransomware attacks in controlled tests, while McAfee's ransomware protection is less reliable. Both offer limited VPN services, with Bitdefender providing 200MB per day and McAfee offering between 250MB and 500MB per month. McAfee completes scans more quickly but uses more CPU, while Bitdefender is more thorough. Bitdefender includes additional security features like anti-tracker and secure browser, whereas McAfee's features are more limited.
When Digital Guardians Turn Rogue: Inside the Avast Antivirus Supply Chain Attack That Exposed Millions
Tech Optimizer
January 30, 2026

When Digital Guardians Turn Rogue: Inside the Avast Antivirus Supply Chain Attack That Exposed Millions

Avast's automatic update system was compromised, allowing malicious code to be distributed through its official channels, affecting potentially millions of users. This breach is characterized as a sophisticated supply chain attack, which exploited the software update mechanism, making it difficult to detect as the malware appeared legitimate. Security analysts noted a 300% increase in supply chain attacks over the past three years, with this incident highlighting vulnerabilities in security solutions. Avast has initiated an incident response, revoked compromised digital certificates, and is collaborating with cybersecurity firms to address the breach. European regulators have begun inquiries into Avast's data protection measures, and legal experts anticipate class-action lawsuits from affected users. The incident underscores a trend of attackers targeting security infrastructure itself, prompting calls for improved software distribution security and industry-wide standards.
Search