Crashfix Masqueraded Softwareprotection Task

nomit vyas@xoxo

•updated Feb 10, 2026•5•0•63

Detects the creation of a scheduled task named 'SoftwareProtection' that executes a Python script. This is a persistence mechanism used by the CrashFix campaign to masquerade as a legitimate Windows service.