Campaign · active

Repeated static TTP

Correlated evidence: js_hidden_powershell:hidden / non-interactive powershell invocation in package code — `-windowstyle hidden`, `irm | iex`, `windowshide: true`, or equivalent — used to download-and-run payloads on windows installers.

First seen 2026-05-30 · last seen 2026-06-03