malware Archives

Winsage

April 16, 2026

Fake Proton VPN sites are pushing NWHStealer malware to Windows users

A malware campaign is utilizing counterfeit Proton VPN websites and other deceptive tactics to distribute a Windows infostealer known as NWHStealer. This malware extracts sensitive information, including browser credentials and cryptocurrency wallet details, and operates stealthily by injecting itself into legitimate processes. Two primary infection vectors have been identified: malicious ZIP archives on a free web hosting platform and trojanized installers from fake Proton VPN sites. The malware employs DLL hijacking and can exfiltrate data to a command-and-control server while ensuring persistence through scheduled tasks and disguising payloads as legitimate system processes. It also exploits the Windows cmstp.exe utility to bypass User Account Control. Users are advised to avoid downloading software from unofficial sources and to verify file signatures and publisher information.

Tech Optimizer

April 16, 2026

‘Anyone with $10 could have walked straight through’: Report warns this legit-looking software is actually antivirus-killing adware

Security researchers at Huntress discovered adware signed by Dragon Boss Solutions LLC that primarily displayed unwanted advertisements and redirected users to various sites. The malware included a sophisticated update mechanism that disabled antivirus programs. The primary update domain and its backup were not registered, making them exploitable. Tens of thousands of endpoints were compromised, affecting universities, operational technology networks, government agencies, and Fortune 500 firms.

Tech Optimizer

April 16, 2026

Best Antivirus Software for Windows PCs in 2026

Bitdefender Total Security offers real-time malware and virus detection, multi-layer ransomware protection, a limited daily data VPN, a password manager, parental controls, and webcam protection. It is compatible with Windows, Mac, Android, and iOS. Pros include excellent detection ratings, minimal system impact, and coverage for up to five devices. Cons are a VPN data cap unless upgraded, significant renewal price increases, and some advanced features being buried in menus. Surfshark Antivirus provides real-time malware scanning, webcam and microphone protection, data breach alerts, and is bundled with Surfshark VPN. It is available on Windows and Android. Pros include competitive pricing when bundled with VPN, a clean interface, and decent malware detection. Cons are fewer features compared to dedicated suites, limited iOS support, and being relatively new in the antivirus space. Norton 360 includes real-time threat detection, LifeLock identity monitoring (on higher tiers), a built-in VPN with no data cap, cloud backup, and a password manager. It supports multiple platforms. Pros are strong overall protection, dark web monitoring alerts, and no VPN data limits. Cons include a higher starting price, automatic renewal enabled by default, and being resource-heavy on older machines. Avast Free Antivirus offers real-time virus and malware protection, a Wi-Fi network scanner, a browser cleanup tool, and a basic ransomware shield. It is available on multiple platforms. Pros include core protection for free, lightweight installation, and an extensive threat database. Cons are aggressive upselling, past privacy concerns, and advanced features locked behind a subscription. Malwarebytes focuses on malware and adware detection, offering real-time protection (Premium only), a browser guard extension, and a light system footprint. It is available on multiple platforms. Pros include excellent detection of adware and a user-friendly interface. Cons are the lack of real-time protection in the free version and fewer features compared to full-suite competitors. Free antivirus software should prioritize real-time protection, coverage beyond basic viruses, a browser extension for blocking suspicious sites, and automatic updates. Free versions typically handle common threats adequately but lack advanced features and support found in paid versions. Some free tools may collect user data, raising privacy concerns. To install antivirus software on Windows 10, download it from the official website, follow setup instructions, and ensure background protection and automatic updates are enabled. Transitioning from Windows Defender is usually managed automatically by most antivirus programs. Running two real-time scanners can cause conflicts; instead, pair a primary antivirus with a secondary tool like Malwarebytes for manual scans. If a paid antivirus plan is not renewed, protection may revert to a limited mode or cease entirely. Microsoft Defender offers adequate protection but lacks additional features like a VPN or identity monitoring. Standard antivirus plans typically range from to 0 annually, with renewal prices often increasing.

Tech Optimizer

April 16, 2026

MiningDropper Android Malware Exploits Lumolight App

Researchers at Cyble Research and Intelligence Labs (CRIL) have discovered an Android malware framework called MiningDropper, which is being used in various campaigns to distribute malicious payloads such as cryptocurrency miners, infostealers, Remote Access Trojans (RATs), and banking malware. Over 1,500 MiningDropper samples were detected in one month, with many showing minimal antivirus detection. MiningDropper operates as a multi-stage delivery framework that employs techniques like XOR-based obfuscation and AES encryption to evade detection. A recent variant uses a trojanized version of the Lumolight application as the initial infection vector, often spread through phishing links and fraudulent websites. The malware executes a series of stages, starting with decrypting an embedded asset and loading additional payloads, including a counterfeit Google Play update interface to deceive users. Two main campaign clusters have been identified: an infostealer campaign targeting Indian users by impersonating trusted entities, and a global campaign distributing the BTMOB RAT, which enables credential theft and device takeover. The final payload capabilities include extracting sensitive data, enabling full device compromise, facilitating financial fraud, and unauthorized cryptocurrency mining. MiningDropper's modularity allows it to adapt and scale across various campaigns while maintaining low detection rates.

Winsage

April 16, 2026

Microsoft’s latest Windows update now confirms if your PC is Secure Boot-protected

Microsoft has introduced a new feature in Windows 11 and Windows 10 that informs users about the status of Secure Boot as part of the April Patch Tuesday update. This feature includes a visual indicator that shows whether devices have the latest Secure Boot certificates, which protect against bootkit malware. The Secure Boot icon can display in green, yellow, or red, indicating different security statuses: green means secure with no actions needed, yellow indicates a pending safety recommendation, and red signals that immediate attention is required. Users can check their Secure Boot status through Settings in both operating systems. It is important to install the latest Windows updates to ensure devices have the most recent Secure Boot certificates, as older certificates will expire in June. The April updates also address 164 vulnerabilities, including eight classified as critical and two identified as zero-day flaws. Users are advised to prioritize these updates to maintain system security.

Tech Optimizer

April 16, 2026

Trend Micro Security Suite Pro Plus Review 2026: Is It The Best Protection?

The review of Trend Micro Security Suite Pro Plus highlights its features, pricing, and performance. The subscription costs A.95 for a 12-month period and includes multi-device antivirus protection, anti-scam software, a VPN, and identity theft protection. The pricing structure for other plans ranges from A.95 for Maximum Security to A9.95 for Security Suite Ultimate. Key features include AI-scam detection, gamer mode, and Folder Shield for ransomware protection. The installation process requires separate logins for each component, which is seen as outdated. The user interface is functional but minimalistic, and compatibility extends to Windows, MacOS, iOS, and Android. The VPN is developed in-house, and phishing protection is provided through a browser extension. Lab tests show mixed results, with Trend Micro performing well in real-time web threat protection but lagging in offline malware detection. Overall, it is considered a competitively priced option for online security.

Tech Optimizer

April 15, 2026

Bitdefender Total Security

Bitdefender Total Security includes features such as a network security inspector, advanced ransomware defense, a hardened browser, and an active Do Not Track system. It offers a two-tier pricing model: an individual subscription for .99 per year for five licenses and a family subscription for .99 for 25 licenses, which includes parental controls. The software features an interface similar to Bitdefender Antivirus Plus, with user-configurable buttons for quick access to features. It boasts high scores from independent antivirus testing labs and excels in malware protection and antiphishing tests. Bitdefender includes a SecurePass password manager, firewall protection, spam filtering, webcam protection, and cryptomining protection. The parental control features allow parents to manage their children's online activities, but they may not be as effective as dedicated solutions. Bitdefender Total Security provides protection for macOS and Android, with high ratings for its performance on these platforms. The Android app includes malware scanning, web protection, and anti-theft features. The Bitdefender Central app allows users to manage their security settings from mobile devices.

Tech Optimizer

April 15, 2026

Malware Is Scary. Here’s CNET’s Guide to Cleaning an Infected Laptop

88% of U.S. adults with laptops have taken measures against potential malware in the past year. Among those who encountered malware, 60% manually deleted the file or closed the offending website, while 35% initiated an anti-malware scan. Recommended steps for responding to a malware infection include disconnecting the device from Wi-Fi, connecting to a guest network, using antivirus software to remove the threat, and performing a factory reset or wiping the hard drive if necessary. It is advised to run at least two different antivirus programs to ensure comprehensive protection and to avoid restoring data from backups that may harbor malware.

Tech Optimizer

April 15, 2026

Avast Antivirus: Free Protection Faces Rising AI Threats in Cybersecurity Market

Avast Antivirus offers a robust free version with premium features, providing high-quality protection against cyber threats, including viruses, spyware, and ransomware. Key features include Smart Scan, Password Manager, and Network Inspector, which help users identify vulnerabilities and safeguard their data. Avast has a global user base of over 435 million and is particularly relevant in the U.S., where data breaches affect millions annually. The company operates under Gen Digital, which acquired Avast in 2022, leveraging a freemium model to attract users and upsell advanced features. Avast focuses on AI-driven threat detection and maintains a strong market position against competitors like Norton and McAfee. The global cybersecurity market has surpassed 0 billion, driven by increasing threats, and Avast counters these with machine learning capabilities. Risks for Avast include zero-day exploits, privacy concerns, and competition from built-in OS protections. Avast's cloud-based updates and multilingual support enhance its appeal, while its integration with smart home devices is planned for the future.

Winsage

April 15, 2026

Windows Update Warning: Fake Windows 11 24H2 Site Pushes Password-Stealing Malware

A sophisticated fake Windows update site has emerged, designed to mimic Microsoft’s branding to distribute malware, specifically targeting individuals seeking early access to Windows 11 version 24H2. The fraudulent site resembles a legitimate cumulative update download page, using familiar design elements to evade detection. The malware operates as an information-stealing entity, targeting saved passwords and browser sessions, potentially bypassing two-factor authentication. It transmits stolen credentials through encrypted channels to external servers. The installer uses legitimate packaging tools to minimize detection and employs obfuscated scripts within legitimate software components. The campaign modifies system startup entries and creates disguised shortcuts to maintain persistence. Researchers noted the use of a typosquatted domain and meticulously spoofed file properties. As of April 2026, Microsoft has not released Windows 11 version 24H2 to the public, and legitimate updates are only available through Windows Update. Users are advised to obtain updates exclusively through official channels and keep security features updated.