Potemkin Loader Base64 Encoded PowerShell Execution

nomit vyas@xoxo

•updated Jun 25, 2026•0•0•11

Detects the execution of PowerShell via explorer.exe containing a long Base64-encoded command string, which is characteristic of the Potemkin Loader used in ClickFix-style attacks to evade detection.