PowerShell Retrieves and Expands a Mining Package

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•1•0•2

Detects PowerShell downloading an archive and expanding it into a user-writable directory with mining-related filenames or parameters. This behavior is indicative of cryptojacking campaigns where adversaries use compromised systems to mine cryptocurrency.