CryptoBandits: JS Payload Staged in Public\Documents 5-char Subfolder then Executed via wscript/cscript Followed by curl

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects a multi-stage attack pattern involving the creation of JavaScript or XML files in a specific public user directory, followed by their execution via wscript.exe or cscript.exe, and subsequently, the spawning of curl.exe by these script hosts to download additional content. This sequence is indicative of malware staging and execution, often used for initial access or further payload delivery.