Kimsuky JSE Loader Spawning Hidden PowerShell with Encoded ProgramData Payload

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the execution of PowerShell via WScript or CScript (ActiveX Scripting hosts) where the PowerShell command line includes suspicious arguments typically used for obfuscation, bypassing security policies, or launching payloads from the ProgramData directory.