Kimsuky JSE Loader Executed from User Directories via Office or Email Client

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the execution of JScript Encoded (.jse) files via wscript.exe or cscript.exe when spawned by Office applications or email clients. This pattern is indicative of Kimsuky initial stage payloads, where a malicious lure file is dropped into a user-writable directory (e.g., Temp, AppData, Downloads) and subsequently executed.