Cybersecurity articles tagged #PowerShell on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/faronics-deploy-abused-by-phishing-actors-to-install-screenconnecthttps://runtimerebel.com/blog/faronics-deploy-abused-by-phishing-actors-to-install-screenconnectPhishing actors are abusing the legitimate Faronics Deploy endpoint management tool to gain remote access and install ScreenConnect via malicious installers.Wed, 02 Sep 2026 01:58:12 GMTScreenconnectPhishingRemote Access TrojanHuntressPowerShellhttps://runtimerebel.com/blog/terminalfix-powershell-weaponization-in-enterprise-attackshttps://runtimerebel.com/blog/terminalfix-powershell-weaponization-in-enterprise-attacksAnalysis of 'TerminalFix' campaign, detailing PowerShell weaponization, multistage attack chain, and reverse tunnels into enterprise networks.Tue, 01 Sep 2026 12:56:24 GMTTerminalFixPowerShellReverse TunnelEnterprise AttacksThreat Campaignhttps://runtimerebel.com/blog/doublecup-malware-appended-powershell-payloads-in-png-fileshttps://runtimerebel.com/blog/doublecup-malware-appended-powershell-payloads-in-png-filesAnalysis of DOUBLECUP malware reveals a deceptive technique: appending cleartext PowerShell payloads to PNG image files, bypassing traditional steganography.Mon, 24 Aug 2026 08:39:29 GMTMalwarePowerShellSteganographyThreat IntelligenceDOUBLECUPhttps://runtimerebel.com/blog/entra-log-analysis-detecting-password-spray-attacks-with-powershellhttps://runtimerebel.com/blog/entra-log-analysis-detecting-password-spray-attacks-with-powershellLearn to analyze Microsoft Entra sign-in logs using PowerShell to detect password spray attacks and anomalous successful logins from unexpected geographic locations.Fri, 21 Aug 2026 08:33:19 GMTEntra IDAzure ADPowerShellThreat DetectionIdentity Accesshttps://runtimerebel.com/blog/auditing-entra-id-mfa-gaps-with-powershell-and-microsoft-graphhttps://runtimerebel.com/blog/auditing-entra-id-mfa-gaps-with-powershell-and-microsoft-graphA new PowerShell script helps security teams identify Microsoft Entra ID users not registered for MFA or using weaker authentication methods.Fri, 21 Aug 2026 08:32:39 GMTMicrosoft Entra IDMFAPowerShellIdentity AccessMicrosoft Graphhttps://runtimerebel.com/blog/powershell-and-wmi-detection-analyzing-suspicious-command-lineshttps://runtimerebel.com/blog/powershell-and-wmi-detection-analyzing-suspicious-command-linesLearn to detect obfuscated PowerShell commands and malicious WMI activity through advanced command-line monitoring and log analysis for security teams.Fri, 17 Jul 2026 06:18:20 GMTPowerShellWMICommand Line AnalysisWindows SecurityDetection Engineeringhttps://runtimerebel.com/blog/analyzing-remcos-rat-delivery-via-malicious-lnk-fileshttps://runtimerebel.com/blog/analyzing-remcos-rat-delivery-via-malicious-lnk-filesTechnical analysis of how threat actors use deceptive LNK files and obfuscated PowerShell to deliver Remcos RAT, including detection and mitigation strategies.Mon, 13 Jul 2026 02:56:21 GMTRemcosLNKPowerShellPhishinghttps://runtimerebel.com/blog/veil-drop-attacks-deploy-purelog-info-stealer-via-blogspot-powershellhttps://runtimerebel.com/blog/veil-drop-attacks-deploy-purelog-info-stealer-via-blogspot-powershellAnalysis of Veil#Drop attacks, a sophisticated framework abusing Blogspot and PowerShell to deploy PureLog information stealer with fileless techniques and evasion.Mon, 06 Jul 2026 21:40:18 GMTVeil DropPureLogInformation StealerBlogspotPowerShellFileless MalwareSecuronixhttps://runtimerebel.com/blog/analysis-of-obfuscated-powershell-loaders-delivering-remcos-rathttps://runtimerebel.com/blog/analysis-of-obfuscated-powershell-loaders-delivering-remcos-ratTechnical breakdown of a multi-stage PowerShell malware loader using scheduled tasks for persistence and Remcos RAT as the final payload.Tue, 23 Jun 2026 09:29:44 GMTRemcos RATPowerShellMalware LoaderPersistencehttps://runtimerebel.com/blog/netsupport-rat-infection-how-to-detect-unidentified-loader-exploitshttps://runtimerebel.com/blog/netsupport-rat-infection-how-to-detect-unidentified-loader-exploitsAnalyze the multi-stage infection chain of an unidentified loader delivering NetSupport RAT, featuring technical breakdowns of JavaScript and PowerShell TTPs.Mon, 01 Jun 2026 01:04:07 GMTNetSupport RATMalware AnalysisPowerShellJavaScriptLoaderhttps://runtimerebel.com/blog/weaponized-trust-analyzing-the-abuse-of-administrative-utilitieshttps://runtimerebel.com/blog/weaponized-trust-analyzing-the-abuse-of-administrative-utilitiesResearch reveals how threat actors leverage legitimate tools like PowerShell and WMIC to bypass detection by masquerading as routine administration.Fri, 15 May 2026 12:44:24 GMTLiving-off-the-LandPowerShellWmicAdversary TacticsBitdefenderhttps://runtimerebel.com/blog/powmix-botnet-targets-czech-workers-via-randomized-c2-traffichttps://runtimerebel.com/blog/powmix-botnet-targets-czech-workers-via-randomized-c2-trafficResearchers uncover the PowMix botnet targeting the Czech workforce with evasive randomized C2 beaconing to bypass network signature detections.Thu, 16 Apr 2026 20:20:25 GMTPowMixBotnetCzech RepublicCisco TalosC2 EvasionPowerShellhttps://runtimerebel.com/blog/dprk-hackers-abuse-github-infrastructure-for-c2-in-south-koreahttps://runtimerebel.com/blog/dprk-hackers-abuse-github-infrastructure-for-c2-in-south-koreaNorth Korean state-sponsored actors are leveraging GitHub as a command-and-control platform in complex multi-stage attacks targeting South Korean organizations.Mon, 06 Apr 2026 20:17:41 GMTDPRKLazarus GroupGitHub C2South KoreaLNKPowerShellhttps://runtimerebel.com/blog/smartapesg-campaign-multi-rat-distribution-via-malicious-archiveshttps://runtimerebel.com/blog/smartapesg-campaign-multi-rat-distribution-via-malicious-archivesAnalysis of the SmartApeSG campaign leveraging phishing, LNK files, and scripts to distribute Remcos RAT, NetSupport RAT, StealC, and Sectop RAT. Learn mitigation.Wed, 25 Mar 2026 04:43:52 GMTSmartApeSGRemcos RATNetSupport RATStealCSectop RATArechclient2PhishingLNK FilesPowerShellVBScripthttps://runtimerebel.com/blog/installfix-campaign-cloned-ai-tool-sites-distribute-info-stealershttps://runtimerebel.com/blog/installfix-campaign-cloned-ai-tool-sites-distribute-info-stealersThe InstallFix campaign uses cloned AI tool websites and malicious PowerShell commands to distribute info-stealers like Lumma and Vidar. Stay protected.Mon, 09 Mar 2026 12:19:23 GMTInstallFixAI ToolsLumma StealerPowerShellInfostealerhttps://runtimerebel.com/blog/xworm-rat-delivery-analyzing-multi-stage-infection-chainshttps://runtimerebel.com/blog/xworm-rat-delivery-analyzing-multi-stage-infection-chainsNew XWorm malware waves utilize multi-technology delivery involving LNK files and PowerShell. Learn how to detect and mitigate XWorm RAT infections.Wed, 04 Mar 2026 12:21:50 GMTXWormRemote Access TrojanPowerShellMalicious LNKVBScripthttps://runtimerebel.com/blog/trojanized-gaming-tools-deliver-java-based-rat-via-powershellhttps://runtimerebel.com/blog/trojanized-gaming-tools-deliver-java-based-rat-via-powershellSecurity researchers identify a malware campaign using trojanized gaming tools to deliver a Java-based RAT using PowerShell and portable Java runtimes.Fri, 27 Feb 2026 12:17:15 GMTJava RATPowerShellSocial EngineeringMalicious DownloaderGaming UtilitiesJRE Staging