TL;DR
China fines Trip.com $765 million for forcing hotel partners into exclusive deals and controlling their pricing

Skylight, the free ocean-monitoring platform built by Seattle’s Allen Institute for AI (Ai2), launched an AI agent that gives maritime analysts answers to plain-language questions about what’s happening across the world’s oceans, from illegal fishing to vessels that have gone dark.
The agent, dubbed Shippy, runs on Skylight’s live vessel-tracking and satellite data, with every answer linking back to the underlying records so analysts can verify and reproduce it.
Skylight is one of a group of environmental projects that moved in 2021 to Ai2 from Vulcan Inc., now known as Vale Group, the late Microsoft co-founder Paul Allen’s holding company.
Researchers at Skylight have spent years building tools to spot illegal, unreported and unregulated fishing, which it says accounts for billions of dollars in losses each year and hits developing countries that depend on their fisheries the hardest. The platform is free, and Skylight says it is used by more than 300 organizations across about 70 countries.
It combines free satellite data with commercial imagery and vessel-tracking feeds to flag suspicious behavior, such as a ship going dark or two vessels meeting at sea to transfer catch.
Ai2 has open-sourced the computer-vision models behind the project.
Like Skylight itself, Shippy will be free to governments, regional fisheries bodies and qualifying nonprofits. For now it is limited to a small group of agencies and partners, with Skylight planning to expand access to a broader community of users as it updates and improves the tool.
Skylight says it built in limits to keep the agent useful and accountable. Shippy sticks to maritime questions, presents facts without making legal judgments, declines defense-related requests, and stops rather than guess when a question runs past what its data can answer. Decisions such as where to send a patrol, the team says, stay with “the humans in the room.”
The launch reflects a broader shift at Ai2 toward applying AI to specific real-world problems. Former CEO Ali Farhadi and other researchers left earlier this year to join Microsoft, as the Ai2 board reconsidered whether the nonprofit should be trying to go toe-to-toe with heavily funded tech giants in developing advanced AI models.
A new, adult T’Challa is joining the Marvel Cinematic Universe. Kevin Feige hit the stage for Marvel’s Hall H Comic-Con showing on Saturday and, toward the end, gave the audience an update on Black Panther 3. Director Ryan Coogler and actors Winston Duke and Letitia Wright were on hand to welcome David Jonsson to the MCU, who will play T’Challa’s son, T’Challa Jr.
Jonsson has appeared in films such as Alien: Romulus and The Long Walk. While no official title has been shared, Feige revealed that Black Panther 3 is due to hit theaters Dec. 15, 2028.
Coogler, who’s writing and directing the next installment of the series, has reportedly begun production. He helmed the first two Black Panther movies, which brought the late Chadwick Boseman to the screen as the royal hero. T’Challa Jr. appeared as a child at the end of Black Panther 2, and the character will clearly be aged up for the new movie.
It’s rumored that X-Men character Storm will be in the mix, who has a history with Wakanda (and Black Panther) in the comic books. With a standalone X-Men movie in the works and renewed enthusiasm for the mutants since the release of the animated X-Men ‘97 series, an interconnected storyline would make sense for the MCU. Also rumored to appear in the superhero film is Brother Voodoo, a sorcerer-superhero (like Doctor Strange) who also works with the dead.
Black Panther: Wakanda Forever (aka Black Panther 2) introduced Tenoch Huerta’s Namor and his underwater kingdom into the MCU, and he’s slated to surface in this year’s Avengers: Doomsday, along with the new Black Panther, Shuri (played by Wright).
China fines Trip.com $765 million for forcing hotel partners into exclusive deals and controlling their pricing
China’s market regulator fined Trip.com Group $765 million on Saturday after concluding that the country’s largest online travel platform abused its dominant market position. The State Administration for Market Regulation said Trip.com used its traffic allocation algorithms, platform rules and technology to restrict hotel operators from listing on competing services and to control the prices they could charge. The penalty, totaling roughly five billion yuan, includes confiscated gains, a separate fine and an order to refund hotel security deposits.
SAMR launched the investigation in January after receiving complaints that Trip.com was forcing hotel partners into exclusive arrangements and demanding they offer their lowest online rates only on its platform. The regulator found the company had engaged in these practices since 2020, leveraging its control of about 56 percent of China’s online travel market to pressure operators who depended on it for visibility and bookings. Trip.com said in a statement on its official WeChat account that it accepts the decision and will implement rectification measures.
The fine is the largest antitrust penalty SAMR has imposed on a single Chinese tech company since it fined Alibaba 18 billion yuan in 2021 for similar abuse of market dominance. That case, which forced Alibaba to abandon exclusive dealing arrangements with merchants, set the template for Beijing’s broader crackdown on platform monopolies. The Trip.com penalty signals that the regulator’s appetite for enforcement has not waned, even as Beijing has shifted its messaging toward calibrated oversight rather than blanket crackdowns.
The case also reflects regulators’ concern that fierce competition among online travel platforms has been squeezing hotel operators’ margins and contributing to deflationary pressure in parts of the Chinese economy. Beijing has been rewriting its e-commerce law to bring platform companies under tighter domestic oversight, with draft amendments published earlier this month proposing expanded regulatory tools for overseeing algorithms, traffic rules and pricing practices. Trip.com’s penalty lands squarely within that framework.
Founded in 1999, Trip.com operates through brands including Ctrip and Skyscanner and has grown into the world’s largest online booking platform by transaction volume. Its dominance in China gave it leverage to dictate terms to hotel partners, but that same market power made it a regulatory target as Beijing moved to curb what it views as monopolistic behaviour across its technology sector. The company has been ordered to undertake a comprehensive rectification plan, though the specifics of those changes have not yet been disclosed.
The US semiconductor and computing giant declared a revenue of $16.1bn for the period.
Intel has published markedly strong financial results for the second quarter of 2026 that exceeded financial analysts’ expectations.
The US semiconductor and computing giant declared a revenue of $16.1bn for the period, up by 25pc from $12.9bn in Q2 2025 and more than the anticipated ceiling of $14.8bn declared at the end of the first quarter of 2026.
“AI is driving unprecedented demand for compute, and as we continue to execute, Intel is well-positioned to capture sustainable growth across our CPU franchise, ASICs, advanced packaging and vast wafer foundry network,” said Lip-Bu Tan, Intel’s CEO.
“Our Q2 results represent our strongest revenue growth in more than 15 years, enabled by greater speed, accountability and customer focus.”
Gross margin grew to around 40pc from around 28pc year-on-year, while Intel generated $7bn in cash from operations during the recent quarter, it said.
Intel’s Foundry revenue for Q2 was up 31pc year-on-year to $5.8bn; its Client Computing and Physical AI Group grew by 13pc to $8.9bn; and the division for data centres and AI was up 59pc to $6.3bn.
“AI-driven compute continues to strengthen, and to support expected growth this year and next across products and foundry, we are meaningfully increasing our investments in equipment, clean room space and substrates,” said Dave Zinsner, Intel’s CFO.
The company anticipates revenue in the third quarter of 2026 to hit between $15.8bn and $16.8bn, and projects a gross margin of 41pc.
The company’s share price increased by up to 4pc during trading hours yesterday following publication of its financial results.
Intel is estimated to have reduced its headcount by more than 35,000 employees since 2024, with major cuts announced in both 2024 and 2025.
Earlier this month, the company announced a major investment in its Kildare, Ireland facility, where Intel intends to spend €5bn on the Leixlip campus.
Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Mojave Air and Space Port sits in the high desert where the air stays dry and the runways stretch long enough for machines that refuse ordinary limits. On a recent morning there, a prototype Porsche Cayenne Turbo Electric rolled into position under the shadow of Stratolaunch’s Roc. Six jet engines sat silent for the moment. The SUV waited between the twin fuselages of an aircraft whose wings span 385 feet.
Roc is designed to carry enormous payloads into the sky for hypersonic experiments and spacecraft launches. Even when empty, with its six Pratt & Whitney engines cranking out a staggering 340,500 pounds of thrust, the plane can take off at a maximum weight of 1.3 million pounds, which is enormous when compared to modern airliners. Porsche’s new Cayenne has just arrived with a pair of electric motors that provide 1,139 horsepower and 1,500 Nm of torque, an outstanding spec sheet. It takes 2.4 seconds to accelerate from 0 to 60 mph, which is incredible. When things get hairy, the Cayenne has active aerodynamics and, as an option, very heavy-duty carbon-ceramic brakes ready to bail it out.
Sale
Stratolaunch’s engineers had been monitoring the airflow near Roc. During takeoff and landing, a strange small pocket of still air emerges directly behind the main landing gear and just ahead of the tail, and this bubble follows the plane. In principle, a car that was both fast and stable enough could simply sit in the center of this bubble and remain there. That concept evolved into a hunch, which led to a strategy. Straotlaunch had a volunteer driver lined up, none other than former Porsche factory driver Patrick Long. He was joined by crew chiefs Shauntel Williams and John McKinney, who were keeping radio contact with the flight deck crew, as well as Orlando Bloom and a lucky automotive journalist Mat Watson.

The first run began with Long carefully positioning the Cayenne in just the perfect area, applying almost little throttle at all. Roc’s engines burst into life. At roughly 100 mph, he put the Cayenne into boost mode and flew after the plane, matching its stride for stride. The SUV remained right beneath the plane’s gear as it pulled away, and it was apparent as day that the vehicle had the stability to endure the turbulence when the engines lowered. Long later described how, when the engines began to descend after takeoff, he felt a great jolt and the car continued to go as if nothing had happened. He glanced down at the speedometer, and holy moly, the needle was over 170 before he yanked his foot off the throttle and slapped on the carbon-ceramic brakes to reduce the speed before the runway ended.

Landing, on the other hand, is a completely other story since time is everything. Roc is massive, making visual cues scarce, so Long had to merge onto the runway at precisely the exact moment, skillfully maneuvering between the plane’s fuselage such that the automobile appeared under the gear just as the plane touched down. The Stratolaunch crew commanders were right there in the cabin, keeping Long on track with continuous radio calls. The pattern repeated itself over two takeoffs and landings, with all four landings going off as planned. The Cayenne utilized only 13 percent of its battery charge the entire time.

Patrick Long described it as one of the most focused moments he’d ever had in a car. He trusted the data, the automobile, and the pilots. And it appears that the trust paid off, since Jonathan Bearce, the plane’s principal test pilot, was also impressed. From the cockpit, all he could see was a Cayenne-sized black hole, but the footage subsequently revealed it was spot on. Bearce even got to drive the thing himself later on, and he stated it accelerated so quickly that it surprised him. Overall, it was an eye-opening exercise in demonstrating the importance of precision over raw speed.
The idea that cancer could behave like a contagious disease may seem absurd; in humans, cancer cannot be transmitted from one person to another. Yet nature is still full of surprises. In exceptional cases, cancer cells themselves can pass from one individual to another and continue to multiply in a new host. This rare phenomenon has been detected in animals such as dogs, Tasmanian devils, and some species of mollusks, and it seems we can add one more to that exclusive club: catfish.
An international team of researchers has identified a transmissible melanoma in the brown catfish (Ameiurus nebulosus)—the first documented case in fish and also the first recorded in a freshwater ecosystem. Their findings were reported this month in the journal Nature.
The story began in 2012, when fishermen and biologists detected an unusually high number of catfish with black lesions in Lake Memphremagog, a body of water straddling Vermont and Quebec. Previous studies revealed that these spots were malignant melanomas, and that between 23 percent and 37 percent of the specimens examined had these tumors—an unusually high incidence for this species.
“That was surprising,” said Julie Dragon, a researcher at the University of Vermont and co-lead author of the study. “We wanted to know how a bottom-dwelling fish was getting a cancer we associate with exposure to too much sunlight.”
Initially, it was thought that the cause might be some toxic substance or a pathogen linked to pollution. One suspicion was that the flooding caused by Tropical Storm Irene in 2011 had degraded water quality by washing environmental pollutants into the lake. There were also concerns about the health of the lake, which supplies drinking water to more than 175,000 people. However, initial genetic analyses began to point in an unexpected direction.
It was then that the researchers wondered whether the tumors were descended from a single original cancer that had learned to spread among individual fish, rather than arising independently in each fish.
To test this unusual hypothesis, the team sequenced the complete genomes of tumors and healthy tissues from affected fish, and compared the data with that from healthy specimens from different populations.
The results indicated that the tumor cells from different fish were much more closely related to one another than to the animals in which they developed. In other words, the tumors shared their own genetic identity, distinct from that of their hosts. Furthermore, hundreds of thousands of genetic variants appeared repeatedly in the tumors but were absent from the healthy tissues of the same fish.
Such a pattern would be virtually impossible if each melanoma had arisen independently. By way of comparison, the researchers analyzed hundreds of human melanomas and found that nearly all of their mutations were unique to each patient. In contrast, most of the mutations present in the tumors of these fish were shared by numerous individuals—a hallmark of a transmissible clonal cancer.
The big picture: AMD had a busy week, announcing the Ryzen 7 7700X3D CPU for gaming PCs and the Epyc Venice lineup for agentic AI workloads in data centers and high-end workstations. The company also launched the Helios rack-scale AI system at its Advancing AI 2026 event in San Francisco and previewed its next-generation Zen 7 and Zen 8 CPU architectures.
In her keynote speech, AMD CEO Lisa Su revealed that Zen 7 will debut in 2028 with the 7th-generation Epyc “Florence” processors for enterprise and AI data centers. The new core architecture will be divided into classic (Zen 7) and compute-optimized (Zen 7c) versions, with both expected to be manufactured on TSMC’s cutting-edge A16 or A14 process node.
AMD did not reveal any architectural details about Zen 7, but confirmed that Epyc Florence will include both Zen 7 and Zen 7c cores. The Florence processors will also be the first processors in AMD’s portfolio to support the next iterations of MRDIMM and LPDDR memory standards, as well as ACE AI Compute Extensions to accelerate matrix multiplication and AI workloads across the x86 ecosystem.
Epyc Florence will cover the existing SP7 and SP8 platforms, with the SP7 chips delivering high-core-count and flagship performance, while the SP8 versions will offer optimized performance with a focus on value. Both versions will power AMD’s next-gen AI rack solution, “Ferrara,” which will be optimized for high-performance AI host nodes.
Moving beyond Zen 7, AMD added that it has started work on its Zen 8 core architecture, which will debut in 2030 with the company’s 8th-generation Epyc chips, codenamed “Ravenna.” The company did not reveal anything else about either Zen 8 or Epyc Ravenna, including architectural details, process node, core count, or memory support.
Team Red also unveiled the Instinct MI455X AI accelerator with CDNA 5 compute architecture and confirmed that the CDNA 6-based MI500 will debut in 2027, followed by the MI600 in 2028. The company has yet to confirm the CDNA generation, memory configurations, and compute specifications for the MI600.
Moving to the Helios AI rack roadmap, the first-generation models are set to launch this year, powered by Epyc Venice CPUs and the new MI455X accelerator. Helios 500 is slated to arrive in 2027 with Epyc Verano CPUs and Instinct MI500 GPUs, followed by Helios 600 in 2028, powered by Epyc Ferrara and Instinct MI600.
Earlier this week, AMD launched its latest 3D V-Cache CPU, the Ryzen 7 7700X3D. Aimed at gamers on a budget, the new processor comes with 8 Zen 4 cores, 16 threads, and 96MB of L3 cache. The company also unveiled the Zen 6-based Epyc Venice CPUs and revealed key details about its Arm-based Vera CPU, designed specifically for agentic AI workloads in data centers.
The big picture: AMD had a busy week, announcing the Ryzen 7 7700X3D CPU for gaming PCs and the Epyc Venice lineup for agentic AI workloads in data centers and high-end workstations. The company also launched the Helios rack-scale AI system at its Advancing AI 2026 event in San Francisco and previewed its next-generation Zen 7 and Zen 8 CPU architectures.
In her keynote speech, AMD CEO Lisa Su revealed that Zen 7 will debut in 2028 with the 7th-generation Epyc “Florence” processors for enterprise and AI data centers. The new core architecture will be divided into classic (Zen 7) and compute-optimized (Zen 7c) versions, with both expected to be manufactured on TSMC’s cutting-edge A16 or A14 process node.
AMD did not reveal any architectural details about Zen 7, but confirmed that Epyc Florence will include both Zen 7 and Zen 7c cores. The Florence processors will also be the first processors in AMD’s portfolio to support the next iterations of MRDIMM and LPDDR memory standards, as well as ACE AI Compute Extensions to accelerate matrix multiplication and AI workloads across the x86 ecosystem.
Epyc Florence will cover the existing SP7 and SP8 platforms, with the SP7 chips delivering high-core-count and flagship performance, while the SP8 versions will offer optimized performance with a focus on value. Both versions will power AMD’s next-gen AI rack solution, “Ferrara,” which will be optimized for high-performance AI host nodes.
Moving beyond Zen 7, AMD added that it has started work on its Zen 8 core architecture, which will debut in 2030 with the company’s 8th-generation Epyc chips, codenamed “Ravenna.” The company did not reveal anything else about either Zen 8 or Epyc Ravenna, including architectural details, process node, core count, or memory support.
Team Red also unveiled the Instinct MI455X AI accelerator with CDNA 5 compute architecture and confirmed that the CDNA 6-based MI500 will debut in 2027, followed by the MI600 in 2028. The company has yet to confirm the CDNA generation, memory configurations, and compute specifications for the MI600.
Moving to the Helios AI rack roadmap, the first-generation models are set to launch this year, powered by Epyc Venice CPUs and the new MI455X accelerator. Helios 500 is slated to arrive in 2027 with Epyc Verano CPUs and Instinct MI500 GPUs, followed by Helios 600 in 2028, powered by Epyc Ferrara and Instinct MI600.
Earlier this week, AMD launched its latest 3D V-Cache CPU, the Ryzen 7 7700X3D. Aimed at gamers on a budget, the new processor comes with 8 Zen 4 cores, 16 threads, and 96MB of L3 cache. The company also unveiled the Zen 6-based Epyc Venice CPUs and revealed key details about its Arm-based Vera CPU, designed specifically for agentic AI workloads in data centers.
Building your system with some extra capacity makes managing it a bit easier.
If you own a solar system, there’s a good chance you’ll have heard of the 20 percent rule. And if you haven’t, it can be explained easily enough. “n essence, it means estimating how much electricity your house needs, then sizing your solar panel system so that it produces roughly 20 percent more energy than your home uses. Think of it this way: if your home uses 40kWh per day, your panels should be producing 48kWh. But what are the benefits of having this extra energy at your disposal?
It really boils down to savings and guarding against less than optimal solar conditions. Having a system that produces 20 percent more energy should ensure your house has all the power it needs, even during dimmer winter months. There’s also a cost benefit, whereby any excess energy you don’t use can be sent back to the grid resulting in potential banked up credit from your energy supplier. Incentive programs also exist that provide certain discounts the more energy that your home produces. So yes, the 20 percent rule of solar panels can definitely save you money, but it’s not a guarantee of instant savings.
One of the main benefits to the 20 percent rule is offering you extra power for those times when your household’s electricity output is higher than normal. Seasonal variations are a big reason you should consider installing additional panels. The summer months are when you should most feel the benefits. In an era of skyrocketing temperatures where heat records are regularly being broken, it’s only natural people are going to run air conditioning systems frequently during summer. In baking conditions, many folks will appreciate that extra solar cover.
Conversely, having more power to tap into can also come in handy during winter. On especially cold days, that additional energy capacity is going to be appreciated if you’re regularly running your heat for hours on end. More generally, owners of solar panel systems that adhere to the 20 percent rule will find it easier to power their homes on dimmer days when the sun’s rays may be obscured. And in case you’re wondering, here’s what happens when solar panels die.
It’s best to think of the upsides of the 20 percent rule in the long term. While your current panelling may service your energy needs perfectly well today, that’s not to say needs won’t change over the lifespan of your system. Lifestyle changes could easily impact your electricity usage going forward and extra panels could well prove worthwhile if you, say, suddenly start working from home more often. Equally, extra solar cover will be appreciated if you install an air conditioning system in your home or buy an EV.
We now live in a world where scientists at Oxford have created a new light-absorbing material that can turn everyday objects into solar panels. That’s great, but such advances probably won’t save you money anytime soon. What could bag you some savings is the 20 percent rule. Depending on your energy provider, any excess power your system produces that your home doesn’t use can be sent back to the grid, netting you credit from your supplier. In turn, this can help lower future bills, and over the longer term could provide serious savings. Just bear in mind that solar buyback rates can vary wildly from state to state in the US, so big discounts aren’t guaranteed.
That would be a yes… with caveats. The main benefit to owning a solar panel system that provides 20 percent more power than your household normally consumes is that you’re safeguarding against potential real-world solar losses. It’s been a great time to buy a solar generator for a while now, no question, but there are definitely instances where your generator can do with additional help. If you’re reading this in a particularly rainy part of the US or the UK — where near constant cloud cover in all but summer months is very much a thing — the 20% rule is definitely worth considering, and could net you real savings in the long run. That extra percentage of solar capacity can also help the power losses that naturally occur from less than ideal roofing angles and high panel temperatures.
It’s important to note though, that the 20 percent solar panel rule isn’t going to magically save you 20 percent off your energy bill. Ultimately, it’s best to think of it as a buffer against poor weather conditions or periods where your home’s electricity output is higher than normal.
Nvidia is investing $1 billion in Naver and building a $500 billion commercial partnership with SK Group spanning data centers and memory chips
Nvidia will invest $1 billion in South Korean internet company Naver to help finance an AI data center under construction in South Korea, the chipmaker announced late Friday. The funding will allow Naver to more than triple the size of the facility from 55 megawatts to 200 megawatts, with US private equity firm Brookfield agreeing to a nonbinding term sheet to fund up to $9 billion for the project. The site will run on Nvidia’s AI computing hardware.
Separately, Nvidia announced a long-term commercial partnership with SK Group that it described as worth more than $500 billion. The figure includes money Nvidia will spend buying memory chips from SK Hynix, the world’s largest supplier of high-bandwidth memory, as well as purchases by SK Group of Nvidia’s supercomputers. SK Telecom will build more than 2 gigawatts of AI data centers on the Korean Peninsula, with the first facility due to open next year.
The announcements coincide with a visit to Silicon Valley by South Korean President Lee Jae Myung, and additional tech deals between Korean and American companies are reportedly in the works. Nvidia CEO Jensen Huang told Bloomberg Television that South Korea is in a “golden age,” pointing to the country’s booming semiconductor and industrial businesses as reasons to invest. Nvidia will also help SK Hynix design future high-bandwidth memory chips, an effort to guarantee access to the component that remains in short supply because of the global buildout of AI data centers.
The Korea deals are the latest in a year-long investment spree in which Nvidia has committed more than $40 billion to AI equity positions, including $30 billion in OpenAI. Earlier this week the chipmaker signed a separate agreement with Amkor Technology to bolster chip packaging, and it recently completed a trip to Japan that included deals with Toyota and Japanese robotics firms. Critics have described the pattern as circular financing, in which Nvidia invests in companies that then buy its hardware, a structure the chipmaker has replicated with data center operators, neoclouds, and now sovereign AI partners.
For South Korea, the deals represent a bet that its semiconductor industry can remain central to the AI buildout even as geopolitical tensions reshape chip supply chains. Samsung and SK Hynix are the only two companies in the world capable of producing the advanced memory chips that Nvidia’s processors require, and locking in a design partnership with Nvidia gives SK Hynix a structural advantage over its rival. Huang has argued that every country should create its own sovereign AI capability, and South Korea, with its chipmaking expertise and abundant engineering talent, is among the best positioned to do so.
Steam discussion forums are being abused in ClickFix attacks that pretend to be fixes for game and computer problems but actually infect devices with cryptominers.
BleepingComputer learned of the campaign from a reader, who told us threat actors are creating random Steam accounts to post what appears to be helpful fixes for people’s posts about games crashing, lost inventory items, and other technical issues.
The threat actors reply to posts, telling other members to open PowerShell as an administrator and run a command to fix the issue. However, when executing the command, it quietly downloads an XMRig miner executable and launches it on the computer.

These types of attacks are known as ClickFix, a social engineering tactic that displays fake errors, verification prompts, or troubleshooting instructions to trick victims into manually executing malicious commands.
Although ClickFix attacks require interaction from the victim, they are effective because they present users with what appears to be both a legitimate solution for a problem they are having.
Since the victim manually launches the command, the attack can also bypass some security protections that would otherwise automatically block executed malicious code.
The PowerShell script distributed in the Steam campaign masquerades as a Windows optimization utility named “msf utility \ PC Opt.”
When launched, it displays messages claiming to perform numerous maintenance tasks, including cleaning temporary files, flushing the DNS cache, updating drivers, checking the disk, turning off unnecessary startup items, scanning for malware, repairing the Windows image, and running System File Checker.

However, most of these functions do not perform the tasks they claim. Instead, they display fake progress messages and pause for a random period between 1.5 and 8 seconds to make the utility appear legitimate.

The actual malicious activity is hidden in a function named ‘Advanced-Optimization’, which first disables TLS certificate validation and checks that it is running with administrator privileges. If it is not, the script displays an error stating that administrator rights are required and exits.
Once running with elevated privileges, the script creates the ‘C:\Windows\Background’ directory and adds it as an exclusion to Microsoft Defender’s scanning functions.
It also attempts to stop an existing scheduled task named ‘XMRig-[computer name]’ and terminates matching processes named ‘xmrig’ or ‘system’ that are running from the installation directory. It also attempts to delete any XMRig configuration files stored as C:\Windows\Background\config.json.
It is unclear whether this cleanup is intended to remove leftovers from an earlier install of the same malware or another miner already present on the device.
The malware then creates a temporary outbound Windows Firewall rule allowing connections to ‘msfconfig[.]icu‘ over TCP port 443 and downloads the XMRig miner payload from https://msfconfig[.]icu:443/tmp/system.txt into a randomly named temporary file.
Before installing it, the script verifies that the downloaded file is not empty and is a valid executable. If so, it moves the file to C:\Windows\Background\system.exe.
So it launches every time Windows starts, it will create a new scheduled task named “XMRig-[computer name],” that launches the system.exe executable with SYSTEM privileges.
As a general rule, users should never run PowerShell commands provided by unknown users in discussion forums, even when the commands are presented as fixes for a problem they are currently experiencing.
Those who executed the command should check for the ‘C:\Windows\Background’ directory, a Microsoft Defender exclusion for that path, and a scheduled task beginning with ‘XMRig-‘.
If these signs of compromise are detected, you should immediately run an antivirus program to scan for malware and remove anything it finds.
If it does not detect the miner, you should manually stop and remove the XMRig-[computer name] scheduled task, remove the Microsoft Defender exclusion for C:\Windows\Background, and delete the folder and its contents.
Ultimately, it may be safer to reinstall the operating system, as there is no way to know whether the downloaded payload performed additional malicious actions while it was running.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Weekend Open Thread: Brooks Brothers
Democrats look to World Cup watch parties to register thousands of voters
Big Money Is Entering XRP
Sail Virtually Aboard The “Itanic” With IA-64 Emulator
Turtle Beach Command Series KB7 review: a nifty screen-equipped gaming keyboard
Grayscale Files For Worldcoin ETF, WLD Registers Sharp Rise
Unregistered fitter used Gas Safe logo on business flyers
New Jersey voter registration controversy explained: How 6,600 noncitizens got on the rolls, and what happens next
Johnny Depp’s R-Rated Gothic Cult Classic Gets New Release Ahead of Sydney Sweeney Remake
Ethics, other provisions in crypto Clarity Act to be further discussed
Watch Flock Safety CEO Garrett Langley discuss the future of surveillance at TechCrunch Disrupt 2026
Shanghai science forum photos show China’s AI and robotics advances in rivalry with US
Circle’s President Sold Over 360,000 Shares, The Filings Explain Why
Subway Sandwich Computers Get a Second Life as Gaming Machines
2026 3M Open leaderboard: Scottie Scheffler finds putter in Round 1, sits three back
The Peugeot Family: How 200 Years of an “Old Money” Dynasty Died in A Boardroom
16 Dresses for the High Summer Event
How To Use Claude’s Reflect Dashboard And Learn When It’s Time To Touch Grass
The 35 Best Board Games for Family Game Night
Stephen Colbert Returns to Social Media After Late Show End
You must be logged in to post a comment Login