powershell3 articles
TerminalFix: The ClickFix Variant That Hands Attackers Your Entire Network
is a new variant of ClickFix malware that tricks users into running malicious PowerShell commands via fake Cloudflare CAPTCHA pages on compromised websites. The attack uses a multi-stage process involving DLL sideloading, steganographic payload extraction, and Active Directory reconnaissance, ultimately deploying a Python-based reverse-tunnel backdoor that grants attackers persistent access to the victim's internal network. Microsoft warns the technique is particularly dangerous as it can be exploited to escalate privileges, steal data, and deploy ransomware, and recommends restricting PowerShell execution, monitoring for DLL sideloading, and training employees to recognise ClickFix-style attacks.
AI-Written PowerShell Scripts Are Now a Burglar's Tool of Choice
An unknown threat actor used an AI-generated PowerShell script to enumerate Active Directory environments, gaining RDP access via stolen credentials before systematically harvesting user, computer, and group data and exfiltrating it to a remote server. The script's telltale signs — such as its iteration-style title, over-engineered code, and colour-formatted output — strongly suggest it was produced through repeated prompting of a large language model. While AI is not introducing entirely new attack techniques, it is lowering the barrier to entry for cybercriminals and accelerating attack timelines, allowing less-skilled actors to deploy capable tooling faster than defenders can respond.
VEIL#DROP: How Attackers Are Hiding Malware Inside Google's Blogger
The VEIL#DROP attack chain uses a disguised JavaScript file to trigger a multi-stage malware infection, leveraging Google's Blogger platform to host payloads and bypass reputation-based security defences. The infection employs advanced evasion techniques including dynamic URL generation, runtime script mutation, fileless in-memory execution, and abuse of trusted Microsoft-signed binaries (Living-off-the-Land) to avoid detection. The ultimate goal is to deploy PureLogs Stealer, a .NET-based malware-as-a-service infostealer capable of harvesting sensitive data and potentially enabling deeper network compromise.