TriBack Loader Delivery via Claude.msi/GolddTV.msi VBScript Custom Action

Duo Tech@duotech

•updated Jul 28, 2026•1•0•6

Detects msiexec.exe installing Claude.msi or GolddTV.msi (which use VBScript custom actions to drop the TriBack Loader triad into the Startup folder) or the associated desktop shortcut created under ProgramFiles\SquirrelTemp pointing to the staging VBScript.