PowerShell Download With Spoofed ZoomSDK User-Agent

Tim Peck@timpeck

•updated Apr 28, 2026•17•0•490

Detects PowerShell command lines utilizing Invoke-WebRequest (or aliases) with a spoofed "ZoomSDK" User-Agent for payload delivery. This behavior is associated with BlueNoroff ClickFix campaigns targeting the Web3 sector.