security products Archives

Winsage

July 1, 2026

Do you still need third-party antivirus on your Windows PC?

In April, a statement on the Windows Learning Center claimed that Microsoft Defender Antivirus is sufficient for many Windows 11 users, leading to brief attention before the article was removed a month later without explanation. The link now redirects to the homepage, but the content is still accessible via the Internet Archive. Microsoft has not clarified the removal, and speculation suggests backlash from the third-party security industry may have influenced this decision. Research indicates that the infection rate for consumer PCs in 2023-2024 was 3.07%, lower than the 2.39% for business PCs, suggesting that risks may not be as widespread as often claimed. The 2025 Cybersecurity Threat Report noted that 56% of consumer endpoints that faced an infection in 2024 experienced subsequent infections, with user behavior playing a significant role. A survey found that 54% of Americans rely on default device protection, while 46% use third-party antivirus solutions. Modern antivirus solutions, including Microsoft Defender, achieve protection rates of 99% or higher, with Defender specifically reaching a 99.0% protection rate without false positives. This performance indicates that Defender is adequate for most consumers. Default security measures on platforms are generally effective, with modern antivirus applications blocking 99.2% of threats that bypass other protections. Consequently, 97% of PCs remain free from malware infections, suggesting that improving user training may be more beneficial than investing in superior software. In contrast, businesses face different challenges, as attacks are often executed by sophisticated criminal organizations targeting vulnerabilities in third-party software. Enterprise administrators typically use specialized endpoint security products for centralized management and continuous monitoring, which are essential for protecting business environments.

Tech Optimizer

June 26, 2026

Bitdefender vs Norton vs McAfee 2026: 2 Win Gold, 1 Bronze

In 2026, Bitdefender, Norton 360, and McAfee each achieved a perfect score of 18 out of 18 in AV-TEST’s April evaluation. Bitdefender excels in protection technology and has the lightest footprint among paid tiers. Norton 360 offers an unlimited VPN, substantial cloud backup, and LifeLock identity theft protection, achieving the best real-world protection score in 2025. McAfee is strong in identity protection and unlimited-device pricing but falls short in core malware engine performance. Bitdefender is noted for its advanced threat detection and has a low entry price of .99 for its Antivirus Plus. Norton 360 includes an unlimited VPN and up to 250 GB cloud backup, while McAfee+ Ultimate provides identity theft coverage and three-bureau credit monitoring. All three products received perfect scores in AV-TEST’s April evaluation, but independent lab results from AV-Comparatives showed Norton and Bitdefender as Top-Rated Products, while McAfee did not achieve this status. The specifications comparison reveals that Bitdefender supports up to 25 devices, Norton 360 offers unlimited devices, and McAfee also supports unlimited devices. Bitdefender employs Advanced Threat Defense, Norton uses SONAR and Intrusion Prevention, and McAfee utilizes Real Protect. Norton and McAfee received AV-Comparatives Performance awards in 2025 for their light system impact, while Bitdefender did not receive such recognition. Pricing strategies include significant renewal increases after steep first-year discounts. Customer support varies, with Norton and McAfee providing extensive 24/7 support, while Bitdefender offers limited phone support. The ownership structures differ, with Norton under Gen Digital, McAfee as a private entity, and Bitdefender remaining independent. Real-world scenarios suggest Bitdefender is best for single users, Norton 360 or McAfee+ for families, McAfee+ Ultimate or Norton for identity theft concerns, and Norton 360 for privacy-focused users.

Tech Optimizer

June 19, 2026

Real-World Threats Demand Real Results

AV-Comparatives conducted a Real-World Protection Test from February to May 2026, evaluating 20 consumer security products against real-world internet threats. Seven products received the ADVANCED+ award for their effective protection and low false alarm rates. The complete test report is available for free at av-comparatives.org. The evaluated products included well-known security solutions such as Avast, AVG, Bitdefender, Kaspersky, Microsoft, Norton, and TotalAV. The test aimed to assess how well these products protect against various online threats, including malware embedded in trusted platforms.

Tech Optimizer

June 18, 2026

Real-World Threats Demand Real Results

AV-Comparatives conducted its Real-World Protection Test from February to May 2026, assessing 20 consumer security products against real-world internet threats. Seven products received the ADVANCED+ award for their reliable protection capabilities. The complete test report is available for free at av-comparatives.org. The tested products included well-known names such as Avast, AVG, Bitdefender, Kaspersky, Microsoft, Norton, and TotalAV. The test methodology involved evaluating the products against a curated set of threats and assessing false-positive rates.

Winsage

June 12, 2026

Hackers Use Fake Windows Update Installers to Deliver OnyxC2 Credential Stealer

OnyxC2 is a sophisticated credential stealer available for a subscription fee of 0 per month, distributed through disguised lures such as fake Windows updates and legitimate software installers. It functions as a commercial product with features like an automated payload builder, tiered licensing, and a centralized web dashboard. The malware boasts a 99% detection-evasion rate, successfully evading major antivirus solutions during tests. It is developed in C++, utilizing direct system calls and mutating with each build to avoid detection. OnyxC2 collects data from around 210 applications, targeting 45 web browsers, password managers, cryptocurrency wallets, and FTP clients. The malware is delivered using DLL sideloading, where a password-protected archive contains a legitimate application and a malicious DLL. The attacker's DLL is disguised by inflating its size and is loaded by a trusted binary. The malicious code remains encrypted on disk and decrypts in memory to evade analysis. OnyxC2 communicates with a Cloudflare-fronted command-and-control server to manage infected hosts and execute commands like hardware registration and cookie uploads. The threat extends to business environments, targeting FTP and email clients, with stolen session cookies allowing ongoing access to corporate infrastructure. Implementing anti-data exfiltration controls is recommended as a mitigation strategy.

Winsage

June 2, 2026

PHANTOMPULSE RAT Uses UAC Bypass to Hijack Windows Systems

PHANTOMPULSE is a remote access trojan (RAT) used as a final payload in multi-stage attacks targeting Windows environments. It employs advanced post-exploitation techniques, including process injection, User Account Control (UAC) bypass, and a decentralized blockchain-based command-and-control (C2) mechanism. The malware utilizes three process injection techniques: module stomping, manual DLL mapping, and debug-driven execution. It avoids detection by using direct system calls instead of standard Windows APIs and incorporates a hardware breakpoint mechanism to disable security protections like AMSI and ETW. PHANTOMPULSE retrieves its C2 server address from Ethereum-based transaction data but has a vulnerability that allows defenders to hijack communication. It achieves persistence through scheduled tasks and supports self-healing capabilities. Privilege escalation is done using the "schuac" UAC bypass technique. The malware conducts system reconnaissance focusing on cryptocurrency wallets and messaging apps but does not directly steal credentials. It shows signs of AI-assisted development and shares tactics with DPRK-aligned threat groups, particularly in targeting cryptocurrency platforms.

Tech Optimizer

May 29, 2026

Beyond VPNs: NordVPN’s New All-in-One App Redefines Digital Security

NordVPN has launched an updated application that combines its VPN services with next-generation antivirus capabilities, creating a comprehensive digital security suite. The new offering emphasizes three main features: an advanced VPN for private connectivity, a next-generation antivirus for threat protection, and the Dark Web Monitor™ for data breach monitoring. The updated antivirus solution uses artificial intelligence and behavioral analysis to identify threats in real-time, including phishing and malware. In April 2026, NordVPN reported blocking 4.8 million threats, with over 3 million instances of malware blocked. The company’s Threat Protection Pro includes malware and phishing protection, ad and tracker blocking, vulnerability scanning, and dark web monitoring. Independent evaluations have shown high detection rates for blocking malicious URLs. The cybersecurity industry is seeing a trend towards bundling multiple security tools into single subscription packages, with NordVPN aiming to simplify digital protection for users. The company maintains a commitment to privacy, ensuring minimal data collection for threat assessments.

Tech Optimizer

May 19, 2026

Avast Free Antivirus for US users: core features explained

Avast Free Antivirus is a free security application that provides essential malware protection and additional tools for Windows, macOS, Android, and iOS. It blocks malware and suspicious websites using real-time scanning and integrates with the operating system's security center on Windows. Key features include file shield scanning, web and mail shields, and ransomware-related shields on select platforms. It is available for free download in the US and is popular among home users, families, students, and individual professionals. Avast competes with other antivirus vendors like McAfee and Bitdefender and is often reviewed positively by tech outlets. While it offers core protections, advanced features require paid subscriptions. Users can conduct various types of scans and utilize browser extensions to assess site safety. The software is designed to coexist with Windows built-in security features, but experts advise using additional security measures for online banking and shopping.

Tech Optimizer

May 17, 2026

Avast Antivirus free download and security basics

Avast Antivirus is a consumer-focused security application designed to detect and block malware, unsafe downloads, and dubious websites on personal computers. It employs local scanning and cloud-assisted analysis to assess files and URLs for known or suspicious patterns. The software operates background services that continuously monitor files and web traffic for harmful content on both Windows and Mac systems. Avast offers a free version for personal use, with optional paid upgrades, and provides English-language downloads and support specifically for US users. It is developed by Avast, part of Gen Digital, which is publicly traded on Nasdaq under the ticker GEN. Independent testing organizations like AV-Test and AV-Comparatives evaluate Avast Antivirus, positioning it among mainstream antivirus solutions.

Winsage

May 11, 2026

New GhostLock tool abuses Windows API to block file access

A security researcher has developed a proof-of-concept tool called GhostLock, which exploits a vulnerability in the Windows file API, specifically the 'CreateFileW' function. By manipulating the 'dwShareMode' parameter to grant exclusive access to files, GhostLock can prevent other users or applications from opening those files, resulting in a 'STATUSSHARINGVIOLATION' error. The tool automates the process of opening multiple files on SMB shares, causing access disruptions without requiring elevated privileges. This technique is intended as a disruption attack rather than a destructive one, similar to ransomware, and can serve as a diversion during intrusions. Detection of this attack relies on monitoring the open-file count with ShareAccess set to 0 at the file server layer. Dvash has provided resources for IT teams to enhance detection capabilities against this threat.