PowerShell

Reported Context (111)

The infection chain uses PowerShell to retrieve an encrypted download link that fetches a modular Electron-based loader named ‘Microsoft.exe.’ Fake GitHub Security Tools Deliver Backdoors and Infostealers
Inside is a small Windows app whose only job is to open a web page and run whatever PowerShell that page hands back. Fake Google Workspace MSIX Uses App Installer Configuration to Run Remote PowerShell
The group’s toolset consists of a PowerShell reverse shell that we named Prime ReverseShell, and a C++ browser-data and file stealer that we named BeautyStealer. ESET Details Gorbag’s Cyberespionage Campaign Targeting Ukraine
PowerShell 7.4, 7.5, and 7.6 Brotli Flaw Reaches File-Processing Workflows, Expanding Exposure
bundle or rely on vulnerable Brotli components. Affected technologies include Node.js, Microsoft .NET, PowerShell, Bun, Envoy Proxy, Istio, and the Python Brotli and brotlicffi packages, among others. Cyber Centre Warns of Critical Google Brotli Vulnerability CVE-2026-111497

CVE (1339)

Malware (156)

People (42)

Threat Actors (111)

MITRE ATT&CK (203)

Vendors (92)

Products (427)

Tools (109)

Industries (59)

Countries (69)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.