PSNATCH PowerShell File Stealer Exfiltrating to GitHub via SmartUploader UA

Ibrahim Saud@tektrix

•updated Sep 20, 2026•1•0•1

Detects the use of PowerShell to perform recursive file/directory enumeration within sensitive user profile directories (Desktop, Documents, Downloads, Pictures, OneDrive) immediately followed by a network connection over port 443. This behavior is indicative of potential data staging and exfiltration activity performed by a malicious script or threat actor.