Pony Malware Delivery via .scr Attachment or Password-Protected ZIP

Ibrahim Saud@tektrix

•updated Jun 24, 2026•2•0•7

Detects suspicious execution of .scr (screensaver) files, execution of 'SecureMessage' named executables (potentially Pony malware), and email attachments containing .scr or .zip files, which are common vectors for malware delivery.