APT37 NarwhalRAT curl.exe LoLBin staging via PowerShell ExecutionPolicy Bypass

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•6

Detects instances where PowerShell is invoked with an execution policy bypass flag to copy the 'curl.exe' binary from its legitimate System32 location to user-writable directories (such as AppData, Temp, or Public folders) and renaming it. This activity is often associated with adversaries attempting to evade security controls by masquerading legitimate system utilities.