Loading story…
Security reporting and vendor guidance highlight continued abuse of PowerShell's DownloadString capability to retrieve and execute remote payloads, a technique repeatedly seen in real-world intrusions. Microsoft documents the .NET System.Net.WebClient.DownloadString method as a way to fetch remote content, while Splunk previously published a detection analytic for PowerShell processes invoking DownloadString, warning that the behavior can enable arbitrary code download, execution, unauthorized access, and data exfiltration. The detection mapped the activity to MITRE ATT&CK techniques T1059.001 and T1105 before being replaced with broader file-download coverage.
Case studies cited in the references show the technique appearing in multi-stage attacks involving commodity malware and post-exploitation frameworks. Malwarebytes documented the LazyScripter actor using PowerShell-heavy tradecraft in campaigns tied to tools including Empire and Double RAT, while DFIR reporting described an intrusion chain in which an IcedID infection escalated into Nokoyawa ransomware deployment. Together, the references show DownloadString remaining a common execution and payload-delivery mechanism across malware operations and hands-on-keyboard ransomware activity.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Splunk Threat Research removed the detection 'Any Powershell DownloadString' from its content library and replaced it with 'Windows File Download Via PowerShell' in content library version 5.12.0. The detection record lists an updated date of 2026-05-13.
Microsoft Learn published documentation for the System.Net.WebClient.DownloadString method. This is a documentation publication event explicitly dated in the reference metadata.
The DFIR Report published an intrusion case study describing an attack chain that began with an IcedID macro infection and culminated in Nokoyawa ransomware deployment. The reference does not explicitly anchor the underlying incident to a specific event date in the provided content.
Malwarebytes published research on the LazyScripter threat actor, describing its progression from Empire to Double RAT and related tradecraft. The reference provides no explicit event date beyond the existence of the reporting.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourcedocs.microsoft.com
Open sourcethedfirreport.com
Open sourceblog.malwarebytes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft documents `System.Net.WebClient.DownloadFile` as a .NET method for retrieving files from a remote resource, while Splunk Threat Research highlights the same capability as a common indicator of malicious PowerShell activity when used from endpoint processes. The behavior is frequently associated with attackers and offensive frameworks downloading follow-on payloads that can lead to unauthorized code execution, data exfiltration, or wider compromise. Splunk said its older analytic, **Any Powershell DownloadFile**, was removed from the content library and replaced by **Windows File Download Via PowerShell** with updated logic and grouping. The detection monitors process-execution telemetry from sources including **Sysmon Event ID 1**, **Windows Security Event ID 4688**, and **CrowdStrike ProcessRollup2**, maps to MITRE ATT&CK techniques `T1059.001` and `T1105`, and may require tuning to reduce false positives based on parent process or command-line context.
Aug 12, 2026
Multiple threat reports describe **social-engineering-driven malware delivery** leading to remote access and follow-on payload deployment. Fortinet observed a **multi-stage phishing campaign targeting users in Russia** that delivers **Amnesia RAT** and ransomware via business-themed decoy documents and a malicious `.lnk` shortcut using a double extension (e.g., `*.txt.lnk`). The infection chain uses public cloud services for staging—**GitHub** for scripts and **Dropbox** for binary payloads—and abuses **defendnot** to trick Windows into believing a third-party AV is installed, effectively disabling **Microsoft Defender** before later-stage execution. Separately, Huntress attributed activity to **KongTuke**, which uses **malicious browser extensions** to display fake “browser crash” security alerts (“**CrashFix**”) that pressure users into running attacker-provided commands, and also deploys a Python RAT dubbed **ModeloRAT**. ModeloRAT is described as heavily obfuscated, using **Windows Registry** persistence and **RC4**-encrypted communications, with the ability to deliver additional payloads (DLLs, executables, scripts). Red Canary’s January intelligence update highlights **Scarlet Goldfinch** activity using **paste-and-run** lures and a notable technique of using the Windows `finger` client to pull remote content (e.g., `finger user@IP | cmd`), followed by `curl` download of an archive masquerading as a PDF and extraction via `tar -xf`, culminating in **Remcos** (and sometimes **NetSupport**) delivered via **DLL sideloading**.
Jun 29, 2026
Phishing emails and malicious websites were used to trick users into launching **PowerShell**-driven malware chains that installed infostealers and stole credentials, clipboard data, and host information. In one case, an EDR alert on a finance user’s device showed `msedge.exe` spawning `powershell.exe`, followed by `curl.exe`, a downloaded DLL, and `rundll32.exe`; the decoded Base64 command used an `IEX` and `Net.WebClient.DownloadString` pattern to retrieve remote code after the user clicked an “Outstanding Invoice — Action Required” lure. The payload was identified as an **AgentTesla** variant, and responders isolated the host, revoked session tokens, reset credentials, and found two additional recipients of the same phishing email, though only one clicked and SmartScreen blocked the download. A related intrusion used a phishing site that instructed victims to open PowerShell as administrator and paste an encoded command copied to the clipboard, leading to the download of a ZIP archive and execution of `updater.exe`, a packed PyInstaller-based **DXI Infostealer** sample. The malware used a **UAC bypass** via the `ms-settings` registry hijack and `computerdefaults.exe`, added Microsoft Defender exclusions, disabled protections, collected system, network, antivirus, clipboard, screenshot, and browser-related data, and packaged the results with `rar.exe` before exfiltrating them through the **Telegram API** as command-and-control. The activity showed a consistent pattern of social engineering, PowerShell abuse, defense evasion, staged payload delivery, and HTTPS or Telegram-based data theft.
Jun 29, 2026