Toast Notification Credential Phishing Tool Executed via PowerShell

Bryant Smith@flowstate

•updated Mar 25, 2026•0•30

Detects Invoke-CredentialPhisher (legacy tool) or the sendtoast keyword in PowerShell script blocks. Both are direct indicators of an active toast notification-based credential phishing operation in progress.