LausivLoader: PowerShell reads Kv7408/Kv562 env vars for stage handoff

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•2

Detects the execution of PowerShell via script interpreters (wscript.exe, cscript.exe) or terminal hosts (conhost.exe) where the command line contains specific environment variable lookups and obfuscated string identifiers. This pattern is commonly associated with malware or malicious payloads attempting to execute PowerShell commands indirectly to evade detection.