Kimsuky JSE Loader Self-Deletion and Hidden PowerShell Decode via wscript

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects suspicious activities associated with Kimsuky JSE loaders, specifically the self-deletion of .jse files from the Downloads directory by WScript/CScript, or the execution of hidden PowerShell commands designed to decode .a9oc payloads staged in ProgramData.