Pay2Key Polyglot setup.cmd IEX Self-Read Execution via PowerShell

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects a suspicious PowerShell execution pattern observed in Pay2Key ransomware, where PowerShell attempts to read and execute the contents of a setup.cmd file (referred to by environment variable) using [io.file]::ReadAllText and iex.