OAuth Redirect Malware - Full Attack Chain (Korplug/Znyonm)

Tim Peck@timpeck

•updated Mar 3, 2026•16•0•153

Correlates PowerShell extraction of specific files (steam_monitor, crashhandler, crashlog) with subsequent DLL side-loading where 'crashhandler.dll' is loaded by 'steam_monitor.exe' from a non-standard program or Steam directory, indicating a potential malware infection chain.