Toast Notification Fake Incoming Call Scenario Constructed via PowerShell

Bryant Smith@flowstate

•updated Mar 25, 2026•0•31

Detects PowerShell script blocks containing the scenario="incomingCall" XML attribute, which triggers Windows' special incoming call notification UI with accept/dismiss buttons and an avatar image loaded from an attacker-controlled URL. Sourced from the toastnotify-bof repository incoming-call.xml example payload. Near-zero legitimate enterprise use of this attribute in PowerShell.