PostCSS RAT - PowerShell Expand-Archive Drops update.vbs Launched via wscript

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•1

Detects PowerShell expanding a downloaded archive (winPatch.zip) to %TEMP%\winPatch and subsequently launching the update.vbs bootstrapper via wscript.exe, as observed in the abdrizak PostCSS typosquatting campaign distributing a Windows RAT.