REF8372 OXLOADER PowerShell WebClient Download from Storj

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects the use of PowerShell to initiate web requests to Storj-hosted URLs (link.storjshare.io or .storj.io), utilizing either the WebClient class or the Invoke-WebRequest cmdlet. This behavior is associated with the REF8372 OXLOADER malvertising campaign, where PowerShell scripts are used to download malicious payloads.