PowerShell downloads payload from Cloudflare R2 bucket and posts ACK to dl-callback endpoint

Ethan Andrews@eandrews

•updated Jul 2, 2026•1•0•4

Detects a PowerShell download cradle that retrieves a payload archive from a Cloudflare R2 bucket (pub-*.r2.dev/*.zip) and reports success via an out-of-band HTTP GET to a /dl-callback/ endpoint containing a GUID, consistent with ClickFix loader behavior.