Antivirus

Tech Optimizer
February 19, 2025
In the first half of 2024, Canada reported 41,000 cyber incidents, emphasizing the need for enhanced online security. Norton 360 Deluxe offers a comprehensive security solution that includes features such as dark web monitoring, a built-in VPN, parental controls, and 50GB of cloud storage. A 15-month subscription is currently available at a reduced price, allowing protection for up to five devices against various cyber threats.
Tech Optimizer
February 19, 2025
Amazon is offering a bundle that includes Intuit TurboTax 2024 Deluxe Federal + State and a 15-month subscription to McAfee Total Protection for three devices at a 63% discount. The bundle costs .99, providing savings of off the regular price. TurboTax 2024 Deluxe allows for five federal e-files and one state return, guiding users through over 375 deductions and credits, and includes an Audit Risk Meter. It can import prior year data and essential forms. McAfee Total Protection 2025 features antivirus protection, secure VPN, password manager, and identity monitoring. Both applications are compatible with PC and Mac, with TurboTax requiring MacOS 13 or later.
Tech Optimizer
February 19, 2025
Trend Micro's Threat Hunting team has identified a new tactic used by the Chinese hacking group Earth Preta (Mustang Panda), which employs the Microsoft Application Virtualization Injector to evade antivirus detection. The malware checks for ESET antivirus on the target system and, if absent, exploits the waitfor.exe function to inject malicious code into legitimate processes. Earth Preta uses Setup Factory to deliver its payloads, utilizing MAVInject.exe to inject harmful code. After injection, the malware connects to a command and control (C2) server controlled by the attackers. The attack shares similarities with previous campaigns, supporting attribution to Earth Preta.
Tech Optimizer
February 18, 2025
The XCSSET malware, discovered in 2020, allows cybercriminals remote access to developers' MacBooks and has led to a reassessment of macOS security measures. A new variant of XCSSET has been identified, specifically targeting macOS systems and exploiting vulnerabilities, particularly in keychains, to steal sensitive information like usernames and passwords. This variant spreads through Xcode projects and features enhanced functionality that makes detection and removal more challenging. It employs increased randomization in payload generation and uses both xxd and Base64 encoding. The malware can remain undetected, targeting Xcode projects for payload insertion and extracting data from cryptocurrency wallets and the Notes app. Microsoft has confirmed that its Defender for Endpoint on Mac can detect both the old and new variants of XCSSET, but developers are advised to exercise caution by downloading only from trusted sources, using the latest software versions, inspecting Xcode projects before opening them, and avoiding third-party applications.
Tech Optimizer
February 17, 2025
Apple devices, particularly Macs, are facing an increase in cyberattacks, with a new wave of sophisticated malware targeting sensitive data. The emergence of Atomic Stealer (AMOS) in mid-2023 marked a shift from less harmful adware to more serious threats, with AMOS being marketed as a user-friendly service. By mid-2024, Poseidon became the leading Mac information stealer, responsible for 70% of infections and capable of draining various cryptocurrency wallets and capturing sensitive credentials. Cybercriminals are also using malvertising to lure users into downloading disguised malware. Android users are experiencing an even more severe situation, with a significant rise in phishing attacks. In 2024, researchers identified 22,800 malicious apps designed for phishing, along with thousands capable of reading one-time passwords (OTPs). These apps often mimic legitimate software and can easily infiltrate app stores, including Google Play. While Google Play Protect offers some malware protection, it is not entirely effective. To protect against malware threats, it is recommended to use strong antivirus software, be cautious with downloads and links, keep software updated, use strong and unique passwords, and enable two-factor authentication (2FA) for critical accounts.
Tech Optimizer
February 14, 2025
Job seekers are targeted by a ransomware campaign called "XELERA," which uses counterfeit job offers from the Food Corporation of India (FCI) to lure victims. The campaign begins with spear phishing emails containing a malicious Word document named “FCEI-job-notification.doc.” This document hides an OLE object that extracts a compressed PyInstaller executable called “jobnotification2025.exe,” which is designed to evade antivirus detection. The malware's structure includes a core script (mainscript.pyc) and supporting libraries for system monitoring and network operations. A Discord bot serves as a Command-and-Control server, allowing remote command execution, including privilege escalation, system control, credential theft, and visual disruption. The final stage of the attack involves deploying the XELERA ransomware, which demands a ransom in Litecoin and includes functions to terminate Windows Explorer and download a tool for MBR corruption.
Search