Obfuscated Hidden-Window PowerShell with Chained Environment-Variable Staging and Download Payload

Duo Tech@duotech

•updated Jul 24, 2026•0•0•7

Detects an obfuscated, hidden-window PowerShell loader chaining campaign-specific SET environment-variable assignments to stage a payload path and download a next-stage payload from cdn.zoom-videos infrastructure, consistent with BlueNoroff's ClickFix PowerShell staging technique.