PostCSS RAT Persistence via Registry Run Key (chost.exe/csshost)

Ethan Andrews@eandrews

•updated Jun 23, 2026•0•0•5

Detects the Windows RAT from the PostCSS typosquatting campaign establishing persistence by writing a registry Run key value named 'csshost' via chost.exe. The RAT targets HKCU and HKLM CurrentVersion\Run to survive reboots.