abdrizak PostCSS RAT - wscript VBS, chost.exe loader.py, and TEMP ZIP Extraction

Ibrahim Saud@tektrix

•updated Jun 23, 2026•1•0•12

Detects the post-download execution stage of the abdrizak PostCSS typosquatting Windows RAT campaign. Covers three indicators: (1) wscript.exe executing a .vbs file from %TEMP% or subdirectory (e.g. update.vbs from winPatch), (2) chost.exe or any process launching loader.py as a command-line argument, (3) cmd.exe using tar to extract a .zip archive from %TEMP%.