Potemkin Loader - Silent Archive Extraction via tar.exe

nomit vyas@xoxo

•updated Jun 25, 2026•0•0•3

Detects the silent extraction of ZIP archives using the native Windows tar.exe utility into application data directories. This behavior is indicative of the Potemkin Loader, where attackers stage malicious payloads following an initial download to evade detection.