abdrizak PostCSS Typosquatting - PowerShell Downloader or curl RAT Stage

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•6

Detects the PowerShell downloader stage of the abdrizak PostCSS typosquatting campaign. The malware decodes an AES-encrypted blob in the npm package and executes powershell with ExecutionPolicy Bypass targeting settings.ps1, or invokes curl.exe (from node.exe or powershell.exe) to download a payload from nvidiadriver.net disguised as a Windows driver update.