PostCSS RAT: VBScript tar extraction and chost.exe RAT loader launch

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•4

Detects the PostCSS typosquatting campaign VBScript bootstrapper (update.vbs) using cmd.exe to extract dll.zip via tar, then launching the renamed Python executable chost.exe with loader.py to initialize the Windows RAT payload.