malicious software Archives

Winsage

September 1, 2026

New ClickFix campaign can deploy powerful multi-stage malware directly through Windows Terminal and PowerShell

Security researchers at Microsoft have identified a campaign named "TerminalFix" that exploits compromised websites to trick users into installing a backdoor. Users visiting these sites encounter a deceptive overlay prompting them to complete a fake Cloudflare CAPTCHA, which requires executing a malicious PowerShell command. This leads victims to inadvertently sideload dynamic link libraries (DLLs) and deploy a Python implant that creates encrypted reverse tunnels, allowing attackers to access internal networks.

Tech Optimizer

August 24, 2026

Malwarebytes Review 2026: Safe, But is Free Tier Enough?

Overall Rating: 4.3/5 ⭐ Protection: 4.3 ⭐ Performance: 3.9 ⭐ Features: 4.4 ⭐ Support: 4.8 ⭐ Value: 4.2 ⭐ Pricing starts at .99 for the first year, verified August 2026. Malwarebytes earned the AV-TEST TOP PRODUCT award in March-April 2026, scoring 17.5 out of 18 points. It successfully removed all infections in remediation tests and had no false detections across 1.5 million legitimate samples at AV-TEST. The software can coexist with other antivirus solutions and offers a free version with limited features. The free version lacks ongoing protection after 14 days, while the paid version provides real-time protection. Malwarebytes has a privacy policy stating it does not sell customer data and collects only necessary identifiers. The company was founded in 2008 and is headquartered in Santa Clara, California, having raised a total of 0 million, including a recent investment from Vector Capital in September 2022. It acquired AzireVPN in November 2024. Malwarebytes offers various plans, including Standard, Plus, and Total, with consistent renewal pricing. The Windows version includes comprehensive features, while the Mac version targets adware and browser hijackers. The Android app provides scanning capabilities and phishing protection, and the iPhone app focuses on scam text filtering. Customer support is efficient, with quick responses.

Tech Optimizer

August 21, 2026

How to get a 24-month Surfshark subscription for $2.49 per month

Surfshark offers a suite of online security services, including antivirus software, personal data removal tools, and IP masking, to protect personal data. Currently, it has significant discounts on its plans, such as the Starter plan at an 85% discount, costing .49 per month for a 24-month subscription, plus three additional months free. The Starter plan includes a secure VPN, ad and cookie pop-up blockers, rotating IP, double encryption, app bypass options, and an alternative ID feature. The Surfshark One plan, also at .49 per month, adds antivirus protection, an email scam checker, a web content blocker, a private browsing feature, and data leak alerts. The Surfshark One Plus plan, available for .49 per month, includes all features from the Surfshark One plan and adds online data removal assistance and identity theft protection for US users. Surfshark operates under a no-logs policy and includes a kill switch for added security. The alternative ID feature generates fictitious personal information to reduce spam.

TrendTechie

August 21, 2026

Торренты заполнились фальшивыми билдами GTA 6 с тоннами вирусов и вредоносным ПО

A playable version of GTA 6 has not been released, despite numerous online claims and links on torrent trackers that often contain malicious software. Speculation began with a user named CyberLeek posting alleged gameplay recordings, leading to misinformation, impersonations, and AI-generated videos. Experts from NordVPN have noted an increase in fake leaks and the risks associated with accessing dubious links. Marius Briedis from NordVPN highlighted that fake downloads and credential harvesting thrive in this environment. There are community speculations about potential leaks from Rockstar, but no official comments have been made by Rockstar Games or Take-Two Interactive. An official gameplay reveal for GTA 6 is scheduled for August 27, with the game set to launch on PS5 and Xbox Series on November 19.

Tech Optimizer

August 20, 2026

Hackers Are Using a Fake Roblox Cheat To Access Your Webcam and Steal Data

Roblox is facing privacy concerns due to spyware disguised as an "undetected" version of the Xeno Roblox cheat tool. This malware can access screens, record keystrokes, and activate webcams, allowing attackers to execute remote commands. The infection begins when users download a file resembling a legitimate Xeno installation, often shared on platforms like Discord. The malware, previously known as Powercat, has evolved and operates in three stages: 1. The user executes a file named Xeno.exe, which checks for Java and extracts it if necessary. 2. The malware runs a JAR file disguised as decompiler.exe, performing checks to avoid detection. 3. It masquerades as a legitimate Windows DLL file, logging activities and attempting to escalate privileges. If successful, the malware can control the victim's system, access webcams, log keystrokes, and steal sensitive information, including cryptocurrency wallet credentials. To protect against this spyware, users are advised to avoid unofficial cheats, use antivirus software, refrain from clicking unsolicited links, enable two-factor authentication, inspect User Account Control prompts, and consider identity theft protection services.

AppWizard

August 20, 2026

Google has tightened its rules for uploading apps to Android

A new protocol is being implemented for installing applications from unverified developers on Android devices to enhance user security. Users must confirm their intention to download the app, restart their devices, and wait 24 hours before accessing the newly downloaded app. These requirements also apply to updating apps from unverified developers, ensuring ongoing protection against potential vulnerabilities.

TrendTechie

August 19, 2026

Осторожно троян: пиратские онлайн-версии «Одиссеи» могут скрывать вирусы

Pirated digital copies of the film "Odyssey" are being used to spread the Lumma Stealer malware, which compromises viewers' computers. Bitdefender's internal data shows that users have attempted to download malicious executable files disguised as the film, which has not yet been released on online platforms. These counterfeit copies are circulating on illegal sites, and the Lumma Stealer malware can steal sensitive information from infected devices. Bitdefender identified several bait file names that are actually executable files designed to infect computers rather than play the film. This tactic follows a trend of using popular films to disseminate malware, with similar campaigns documented in the past. Cybercriminals exploit the gap between a film's theatrical release and its availability on legal streaming platforms. Users are advised to watch films only through verified services and to keep their cybersecurity software updated.

Tech Optimizer

August 17, 2026

Best Malware Removal Tools of 2026: Tested on Infected PC

A hands-on evaluation was conducted to assess the effectiveness of various malware removal tools by deliberately infecting a PC and running six different cleanup tools. The recommended steps for users suspecting malware infection include disconnecting from the internet, installing an on-demand scanner, removing detected threats, rebooting the system, and changing passwords. The top malware removal tools identified were: 1. Malwarebytes Free: Quick scan in 2 minutes and 20 seconds; complete removal with no remnants. 2. Bitdefender: Quick scan in 1 minute and 4 seconds; complete removal confirmed. 3. Norton 360: Quick scan in 58 seconds; effective for severely compromised devices. 4. Avast One Free: Quick scan in 1 minute and 12 seconds; complete removal with ongoing protection. 5. McAfee: Full system scan took 16 minutes and 47 seconds; complete removal but slower than others. 6. NordVPN Threat Protection Pro: Focuses on preventing reinfection, does not remove existing malware. Signs of infection include unexpected pop-ups, altered homepage settings, and sluggish performance. For Windows, Safe Mode with Networking is recommended for removal, while Mac users should use Activity Monitor to identify suspicious processes. Android users can utilize Safe Mode and Play Protect for scanning. A factory reset may be necessary if infections persist. Malwarebytes Free and Avast One Free are highlighted as effective free options for malware removal.

Tech Optimizer

August 11, 2026

Fake popular sites offer a free app, instead take over PCs

A fraudulent website mimicking CNN's homepage is promoting a fake "CNN app" that is not affiliated with CNN. This site, along with others impersonating brands like Avast and Stremio, distributes a legitimate remote management tool called O&O Syspectr, which can grant attackers remote access to victims' computers. The installers for these counterfeit apps share the same account ID, indicating they are linked to the same malicious source. Users are misled into downloading these installers, which appear legitimate but allow unauthorized access to their systems. O&O Software has responded by disabling certain features for free accounts and monitoring for abuse. Users are advised to only download software from official sources and verify installer details before execution.

Winsage

August 9, 2026

This VPN firm has created a way to stop Microsoft’s hidden tracking tool on Windows — although it will break some key cloud services

Windscribe has developed an open-source script called deGDID to remove Microsoft's Global Device Identifier (GDID) from Windows systems. The script functions as a firewall against the DeviceAdd endpoint, preventing Microsoft identity services from recognizing the machine as registered. It includes a flag, -Unprotect, to restore default settings if needed. Testing on a Windows 11 machine confirmed its effectiveness, with the -Status flag showing cached identifiers before removal. The tool is compatible with antivirus and endpoint protection but has limitations: it cannot delete keys stored on Microsoft's servers, cannot run on managed systems or domain-joined accounts, and Windows does not provide a built-in method to disable GDID. The identifier persists across IP addresses, regardless of VPN use. Windscribe notes that the script may disrupt certain Microsoft account functionalities, making it a partial solution rather than a comprehensive fix.