PowerShell downloads GoGRPC backdoor via Invoke-WebRequest to sekv*.exe

Ethan Andrews@eandrews

•updated Jul 28, 2026•2•0•10

Detects PowerShell staging commands that download an executable with Invoke-WebRequest to $env:APPDATA\sekv<random>.exe, unblock it, and launch it via Start-Process, consistent with GoGRPC backdoor delivery following a Quick Assist vishing session.