Crashfix Masqueraded Task Persistence

nomit vyas@xoxo

•updated Feb 9, 2026•1•0•58

Detects the creation of a scheduled task named 'SoftwareProtection' used by the CrashFix campaign to execute a renamed Python interpreter for persistence.