Potemkin Loader PowerShell Base64 Execution

nomit vyas@xoxo

•updated Jun 25, 2026•3•0•13

Detects instances of PowerShell executing Base64-encoded commands initiated by Windows Explorer, a common technique used in the Potemkin Loader/ClickFix campaign to evade static analysis and security controls.