Pay2Key setup.cmd Polyglot IEX Fileless Payload via Sysnative PowerShell

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects suspicious fileless execution of PowerShell through a cmd.exe wrapper, specifically leveraging the sysnative path and targeting patterns associated with the Pay2Key ransomware's IEX loader, including specific command-line arguments like 'readalltext' and environment variable usage.