domains Archives

Tech Optimizer

July 10, 2026

Hackers Use Fake VLC Executable and Malicious libvlc.dll to Deploy ValleyRAT

Cybercriminals are exploiting the VLC media player to install ValleyRAT, a remote access trojan, by embedding malware in a seemingly harmless file linked in phishing emails. The attack starts with an email that prompts the victim to download a ZIP archive containing a fake VLC executable and a malicious DLL named libvlc.dll. This method uses DLL sideloading to execute the malware under the guise of a legitimate application. Once executed, the malware establishes persistence by creating a registry entry and connects to a remote server to retrieve the final payload. ValleyRAT employs evasion tactics to avoid detection, including assessing system characteristics before executing harmful actions and using a fileless approach to deliver the payload directly into memory. Researchers have identified indicators of compromise, including specific SHA1 hashes and URLs associated with the malicious campaign.

Winsage

July 8, 2026

Trojanized LetsVPN installer gives attackers remote access to Windows PCs

A malware campaign has been discovered that exploits the VPN service LetsVPN. Researchers from ThreatLocker found a malicious Windows installer that pretends to be the legitimate LetsVPN application while deploying a remote access trojan (RAT) called GoodPersonRAT. The malware allows attackers to control infected systems using stealth techniques. The malicious installer first deploys the RAT and then installs the authentic LetsVPN application, creating an illusion of legitimacy. The package identified as Kuailian_win-setup.86.msi contains the legitimate LetsVPN installer, a loader, and an encrypted payload. GoodPersonRAT features include remote desktop control, file upload/download, command execution, proxying, keylogging, and clipboard monitoring. It specifically targets Telegram Desktop users by archiving critical account information and altering proxy settings. The malware ensures persistence through Windows services and scheduled tasks and can undermine security software. The LetsVPN installer is legitimate and signed, but the MSI package is unsigned and contains malicious components. Users are advised to download software only from official sources and verify digital signatures.

Tech Optimizer

July 4, 2026

How to Use a Virus Checker on Your PC (2026)

Windows includes a built-in virus checker called Microsoft Defender Antivirus, which allows users to conduct virus scans. 1. To initiate a scan, open Windows Security, navigate to Virus & threat protection, and select Quick scan for a fast check. 2. Users can check which antivirus is active by going to Who's protecting me? in Windows Security. If a non-Microsoft antivirus is installed, Microsoft Defender will disable itself. 3. Before scanning, it's important to update the security intelligence by checking for updates in Protection updates. 4. A full scan can be executed by selecting Full scan in Scan options, while a custom scan allows users to specify a location to check. 5. For stubborn malware, Microsoft Defender Offline can be used, which requires a restart of Windows. 6. Scan results and quarantined threats can be reviewed in Protection history after any scan. 7. For additional checks, users can utilize VirusTotal for individual files or links, Microsoft Safety Scanner for a one-time scan, or the Malicious Software Removal Tool for specific malware. 8. Outdated tools like the Chrome Cleanup Tool and Norton Power Eraser should be disregarded as they are no longer effective. Users can scan individual files without scanning the entire PC, and results from the Microsoft Defender Offline scan are found in Protection history. The Microsoft Safety Scanner does not replace real-time antivirus protection, and managed devices can be scanned by IT administrators.

Tech Optimizer

July 3, 2026

Hackers Use Fake VLC Executable and Malicious libvlc.dll to Deploy ValleyRAT

Cybercriminals are using a sophisticated method to bypass security measures by embedding malware within the VLC media player. This campaign exploits VLC to install ValleyRAT, a remote access trojan, through phishing emails that contain links to download a seemingly harmless file. Once the file is opened, it activates a hidden backdoor that evades detection by antivirus solutions. The malware has been active since 2023, with a significant increase in activity noted through 2025 and into 2026, particularly targeting Chinese and Japanese-speaking users. The infection process begins when a victim clicks a link in a phishing email, leading to a ZIP archive containing a disguised executable and a malicious DLL (libvlc.dll). The executable mimics a legitimate VLC file, and when executed, it loads the DLL, allowing the malware to run under the guise of VLC. The malware establishes persistence by creating a registry entry and connects to a remote server to retrieve the final payload. ValleyRAT employs evasion tactics to avoid detection, such as performing checks on system behavior and using a fileless approach to inject its payload directly into memory, avoiding storage on disk. Researchers recommend training employees to recognize suspicious filenames and deploying endpoint detection tools to identify DLL sideloading behavior. For organizations affected by this campaign, isolating compromised systems and reviewing security logs are critical initial steps. Indicators of compromise include a malicious email domain, a ZIP archive containing a fake VLC executable, and a download URL for ValleyRAT.

Winsage

June 25, 2026

Microsoft quietly extends free Windows 10 ESU support to October 2027

Microsoft has extended the free coverage of its Windows 10 Extended Security Updates (ESU) program for consumers by an additional year, now lasting until October 12, 2027. This change was noted in updates to Microsoft's ESU documentation and a blog post. Previously, Windows 10 was set to reach its end of support on October 14, 2025, with initial ESU coverage expiring on October 12, 2026. Consumers can access the extended security updates through various methods, including payment, backing up settings to a Microsoft account, redeeming Microsoft reward points, or for users in the European Economic Area, by logging in with a Microsoft account. Each ESU license can be used on up to 10 devices linked to the same account, and the program is only for personal devices, not those managed through Active Directory or MDM.

Winsage

June 24, 2026

Windows RAT Uses Encrypted HTTP C2 and Registry Persistence After npm Infection

A malware campaign targets Windows systems through a malicious npm package named postcss-minify-selector-parser, which mimics the legitimate postcss-selector-parser. This counterfeit package installs a Remote Access Trojan (RAT) on developer machines, beginning with a multi-stage attack triggered by the installation of the package. The RAT can steal credentials, execute shell commands, and communicate with a remote attacker. Security researchers at JFrog identified this threat and reported it on June 22, 2026, noting that two additional related packages, postcss-minify-selector and aes-decode-runner-pro, are linked to the same publisher and remain live on the npm registry. The RAT employs encrypted HTTP communication with a command-and-control (C2) server and ensures persistence by creating a registry key under the Windows Run key. It has capabilities for remote shell execution, file uploads and downloads, and can steal saved login data from Google Chrome using Windows decryption APIs. The malware is designed for organized batch exfiltration of stolen data. Indicators of compromise include specific IP addresses, domains, file paths, and SHA-256 hashes associated with the malware components. JFrog advises users to remove the malicious packages, inspect their dependency trees, and treat any stored credentials as compromised.

Winsage

June 22, 2026

Microsoft says it’ll force install Microsoft 365 Copilot on Windows 11 with MS 365 Business in the next 30 days

Microsoft is reintroducing the Microsoft 365 Copilot app, which will automatically install on eligible Windows PCs with Microsoft 365 desktop applications between mid-June and mid-July. Users in the European Economic Area will not be affected by this automatic installation. Admins can opt out of the automatic integration. The app will be activated by default, requiring no user intervention. Microsoft is not using the Windows Store for this installation; instead, it relies on the built-in Microsoft 365 Apps updater. Users can disable Copilot features on a case-by-case basis in specific Office apps or change privacy settings to block Copilot functionalities. Microsoft has also made Classic plans available in select regions for users who want a version without Copilot. Administrators can use Office policy settings to block connected experiences that drive Copilot functionalities but must opt out through the Microsoft 365 Apps admin center to prevent installation.

Tech Optimizer

June 20, 2026

Chinese police bust cybercrime ring behind ‘Silver Fox’ Trojan virus

Chinese law enforcement has dismantled cybercrime operations linked to a new variant of the Silver Fox Trojan virus, which targets employees in enterprises and public institutions, particularly in financial roles. The malware allows cybercriminals remote access to steal account credentials, intercept SMS verification codes, and harvest personal information. A criminal syndicate in Jilin province, led by an individual named Chen, developed this Trojan and conducted mass phishing campaigns, resulting in losses exceeding 7 million yuan. Police have taken action against Chen and 26 accomplices, with ongoing investigations. Recommendations for enhancing personal cybersecurity include downloading software from official websites, scrutinizing website domains, verifying links before clicking, and disconnecting compromised computers from the internet. Under China's Criminal Law, unauthorized access to computer systems and data theft can lead to imprisonment and financial penalties.

Tech Optimizer

June 18, 2026

Retro gaming fans are the new target for fake GitHub malware

Retro gaming enthusiasts should be cautious when exploring GitHub projects for tools or plugins, as cybercriminals may disguise malware as homebrew software. A specific incident involved a project called EQVita, which pretended to be a free audio tool for PlayStation Vita but actually contained Windows malware. The downloaded file included three files: Launch.bat, luajit.exe, and x64.txt, with the latter concealing a hidden script that connected to the attacker's server upon execution. This scam is part of a broader trend where counterfeit GitHub repositories distribute SmartLoader malware, which retrieves additional malicious software aimed at stealing passwords and cryptocurrency wallets. The PS Vita community, despite the console's production ceasing, remains active in modding, making it a target for attackers. Legitimate plugins typically come in Vita-compatible formats, while fake ones may feature polished marketing materials and AI-generated descriptions. Users are advised to verify sources, be cautious of suspicious downloads, and utilize security tools like Malwarebytes. If someone has executed the malicious EQVitav1.3.zip file, they should conduct a malware scan, change important passwords, and monitor accounts for unauthorized access. Indicators of compromise include the domains https://github.com/Voistace/EQVita and https://voistace.github.io, and the IP address 85.137.52.21.

BetaBeacon

June 18, 2026

Fake virus alerts are invading mobile games

Cybercriminals sometimes manage to buy advertising space and use it to defraud gamers. The iCloud storage scam is a well-known scam that claims you need to expand your storage or all your files will be deleted. Scammers also use fake warnings to trick users into clicking links or downloading harmful software. Fleeceware apps lure users in with short free trials that quickly convert into hidden subscription fees. The best response to these messages is to ignore them and use an up-to-date anti-malware solution on your devices.