Freshko: Lightweight Open-Source Tool for Local File, Link and Miner Checks Released

Developer kozliq has released Freshko, a compact 400×640 desktop application written in Rust that performs quick local security checks on files, URLs and running processes without uploading data to third-party services. The tool uses on-device YARA-X rules for file scanning, follows URL redirects while querying Cloudflare’s filtering DNS, and scores processes for mining indicators using weighted rules rather than CPU load alone. It deliberately avoids sending files anywhere and keeps link checks private except for the necessary DNS queries to Cloudflare’s 1.1.1.2 and 1.0.0.2 resolvers. Freshko explicitly reports what it could not scan due to size limits, permissions or timeouts instead of falsely claiming a clean result. The project is fully open source, available for macOS and Windows, and positioned as a fast first-look utility rather than a replacement for commercial antivirus or URL scanners.

HabrNovember 1, 2026Translated from Russian

Read at source

Developer kozliq has published Freshko, a small 400 × 640 desktop window featuring a mint-colored pet mascot that lets users quickly inspect a suspicious link, downloaded archive or noisy process without opening the file or sending it anywhere.

The application runs entirely locally on macOS and Windows. Files are hashed and scanned with YARA-X rules on the user’s machine; links are followed through up to eight redirects for a maximum of 25 seconds while each domain is checked against Cloudflare’s filtering DNS before any request is made. Miner detection examines process names, command-line arguments such as “stratum+tcp” or “--algo randomx”, and launch location, but high CPU usage alone does not trigger an alert.

Freshko deliberately does not delete or quarantine anything. It only reports findings and leaves the final decision to the user. Two test rules are included: the harmless EICAR file and indicators for the XMRig miner. The author stresses that the program is not an antivirus and contains no background protection.

Technical safeguards against common pitfalls

URL checking pins resolved addresses inside the HTTP client so that a second DNS query cannot be hijacked after the initial clean response. Local and private IP ranges, credentials in URLs and non-standard ports are rejected immediately. When scanning an entire disk, the tool respects hard limits of 256 MB per file and 20 000 files per run; any skipped items are reported explicitly so the pet mascot never displays a false “Clean” result.

Performance figures measured on Apple Silicon show that a 107 MB folder containing 4 185 files is processed in 3.5 seconds, while a single link check completes in 0.55 seconds. Memory usage of the open window stays around 95 MB.

Comparison with existing services

VirusTotal sends files and URLs to dozens of engines; partners and paid customers can see the results.
Cloudflare URL Scanner renders pages in its own browser and produces public reports by default.
Freshko keeps every file on the device and only contacts Cloudflare DNS for domain reputation during link checks.

The source code and pre-built installers for both platforms are available on GitHub. The author notes that the first version was a larger multi-panel interface that was later simplified to three core actions to avoid promising features the tool does not yet deliver.

Cloudflare EICAR YARA XMRig Apple Silicon

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Malware & Botnets

Malware & Botnets

60 seconds to reboot: how Blaster and Sasser exposed the risks of a disabled Windows firewall

In August 2003 the Blaster worm exploited an unpatched DCOM RPC vulnerability in Windows XP and 2000, forcing systems to reboot after 60 seconds. Nine months later Sasser used a similar LSASS flaw released only 17 days earlier, again triggering automatic reboots. Both worms spread through port 135 or direct network exposure because the built-in firewall remained off by default. The attacks affected hundreds of thousands of machines and disrupted banks, airlines and government networks worldwide. Microsoft responded with Windows XP Service Pack 2, which enabled the firewall at boot time. The two teenage authors were later identified and received light sentences. The incidents highlighted how quickly unpatched systems could be compromised when default network protections were absent.

HabrOct 31, 2026Translated from Russian

Malware & Botnets

Fake GitHub Repositories Mimicking PS5 Game Launchers Infect Windows PCs with Trojans

Researchers at NordVPN have uncovered a malware campaign using fake GitHub repositories that impersonate tools for running PlayStation 5 games on Windows computers. The repositories, named AnyPS5 and Kyttyps5, distribute ZIP archives containing executable files that initiate a multi-stage infection process. Upon execution, the loader checks system memory size, detects virtual machines or cloud servers, and verifies the presence of a physical GPU before proceeding. If the environment appears legitimate, it adds exclusions to Microsoft Defender and decrypts the main payload, believed to be an infostealer targeting passwords and sensitive data. A cleanup script also runs after approximately two minutes to delete components, though traces may remain detectable. NordVPN shared its findings with Tom’s Hardware, emphasizing the need to verify repository owners before running such tools.

AntiMalwareOct 30, 2026Translated from Russian

Malware & Botnets

Yoba Campaign Uses Signed ChatGPT and Claude Binaries for DLL Sideloading and XMRig Deployment

Researchers at Check Point Research have uncovered the Yoba malware campaign that distributes fake desktop clients for ChatGPT and Claude through GitHub repositories. The attackers bundle legitimate signed executables from OpenAI and Anthropic with a malicious DLL that gets loaded via classic sideloading. Once executed, the loader establishes persistence using the Windows Task Scheduler and retrieves additional payloads through Telegram, DNS over HTTPS, and the Catbox file hosting service. The campaign ultimately deploys the XMRig cryptominer, which pauses mining activity when user interaction is detected to avoid detection. No compromise of OpenAI or Anthropic infrastructure was found; the attackers simply repurpose the companies' signed binaries and reputation. The operation primarily targets home users and small-to-medium businesses with Windows systems.

AntiMalwareOct 28, 2026Translated from Russian