Potemkin Loader - AppData Staging Sequence (T1074.001)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•3•0•37

Correlates the ClickFix PowerShell execution with the dropping of the Potemkin loader executable and its associated configuration files into the AppData folder.