Correlated self-deletion of artifact or MicroUpdaterV1 scheduled task after recent creation

Duo Tech@duotech

•updated Aug 6, 2026•3•0•0

Detects self-deleting process artifacts or deletion of a scheduled task named MicroUpdaterV1 shortly after its creation, indicative of loader cleanup behavior used by DOUBLECUP-related payloads.