Havoc C2 - Fake Support Payload Download (T1204.002)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•4

Correlates the user interacting with a browser in kiosk mode (potentially indicating a fake tech support page) and immediately downloading an executable file into the Downloads folder. This behavior is indicative of the Havoc Demon loader being delivered via social engineering tactics.