'Anyone with $10 could have walked straight through': Report warns this legit-looking software is actually antivirus-killing adware

Date:
Thu, 16 Apr 2026 15:35:00 +0000

Description:
Annoying adware turned out to be a piece of malware capable of killing antivirus software.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Tech Radar Pro Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Become a Member in Seconds Unlock instant access to exclusive member features. Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over. You are
now subscribed Your newsletter sign-up was successful Join the club Get full access to premium articles, exclusive features and a growing list of member rewards. Explore An account already exists for this email address, please log in. Subscribe to our newsletter Huntress sinkholes adware signed by Dragon Boss Solutions LLC Malware disabled antivirus, left open update domains exploitable for $10 Tens of thousands of endpoints compromised, including universities, OT networks, governments, and Fortune 500 firms Security researchers Huntress recently stumbled upon a piece of adware that, by all accounts, should have been a boring, run-of-the-mill ad-displaying nuisance. However, what they found under the surface raised a few eyebrows and
warranted deeper investigation.

In late March 2026, Huntress was alerted to a piece of software signed by a company called Dragon Boss Solutions LLC. This company, allegedly working on search monetization research (but instead just displaying unwanted ads and redirects to people) came with an advanced update mechanism that disabled antivirus programs and prevented them from being started again. While analyzing how the malware worked, the researchers discovered that the threat actors did not register the main update domain, or the fallback one which, at the same time, presented a major risk and a huge opportunity to do good. Article continues below You may like This dangerous malware is written in Visual Basic 6.0, and costs less than a PS5 game but poses a very real
threat to your business Top antivirus hacked to push out a malicious update - find out if you're affected Who's watching who? Experts reveal criminals
using fake enterprise software to gain access to company systems Severing the ties More concerning is it turned out to have an open door baked right into its update configuration, one which anyone with $10 could have walked
straight through, Huntress said. In other words, someone could have
registered these domains and thus taken control over a vast network of infected computers.

Instead, it was Huntress who bought the domains, effectively sinkholing the connection from all infected hosts.

Within hours they saw tens of thousands of compromised endpoints reach out looking for instructions that, in the wrong hands, could have been anything.

Analyzing incoming IP addresses, Huntress researchers found 324 infected devices in high-value places, including 221 academic institutions, 41 Operational Technology networks in the energy and transport sectors, 35 municipal governments, state agencies, and public utilities, 24 primary and secondary educational institutions, and 3 healthcare organizations. Furthermore, networks of multiple Fortune 500 companies were compromised, as well. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

To stay safe, the researchers recommend system admins look for WMI event subscriptions containing MbRemoval or MbSetup, scheduled tasks referencing WMILoad or ClockRemoval, and processes signed by Dragon Boss Solutions LLC. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.



======================================================================
Link to news story: https://www.techradar.com/pro/security/anyone-with-usd10-could-have-walked-str aight-through-report-warns-this-legit-looking-software-is-actually-antivirus-k illing-adware


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)