AutoIT3 Process Injection Chain: wscript.exe to charmap.exe via PowerShell/cmd

Ethan Andrews@eandrews

•updated Jul 29, 2026•0•0•11

Detects the AutoIT payload injector multi-stage execution chain (wscript.exe -> powershell.exe -> cmd.exe -> powershell.exe -> autoit3.exe -> charmap.exe) used to deliver VIPKeylogger and MedusaHVNC, culminating in process injection into the legitimate charmap.exe utility.