Werkbit dropper spawns curl/bash to fetch payload from GitHub

Duo Tech@duotech

•updated Jul 14, 2026•3•0•5

Detects instances where the 'Werkbit' process initiates either 'curl' or 'bash' to download files from GitHub-related domains. This behavior is indicative of a living-off-the-land technique used to fetch secondary payloads or scripts during a post-exploitation phase.