Proxyware installs through in-memory PowerShell and hidden startup tasks

At a glance

What this is: Expel details an attack chain in which a freeware install led to staged PowerShell execution, hidden persistence tasks and a proxyware payload.

Why it matters: It matters because benign-looking endpoint activity can mask delayed abuse paths that evade file-based controls, abuse trusted tools and create lasting operational risk.

Context

This incident sits in the gap between routine endpoint administration and malicious post-install activity. PowerShell, Node.js and scheduled tasks are all legitimate tools, which makes them attractive for concealment when attackers want to stage payloads without obvious file drops or immediate detonation.

The identity angle is indirect but real: the attack abused endpoint execution context, SYSTEM-level tasking and software installation trust rather than user credentials. For IAM and PAM teams, the lesson is that control boundaries do not stop at interactive logon when local execution paths and service contexts can be repurposed into persistence.

Key questions

Q: What breaks when PowerShell and BITSAdmin are allowed to run unchecked on user endpoints?

A: The defender loses the distinction between normal administration and attacker staging. Native tools can fetch payloads, conceal process lineage, and help the attacker blend into approved activity, which makes detection dependent on behavioural correlation rather than simple binary allow or deny logic.

Q: Why do delayed scheduled tasks increase endpoint compromise risk?

A: Delayed tasks separate the original compromise from the visible malicious action, which makes incident correlation much harder. A task can sit quietly, check in later, and launch the final payload long after the installer event looked complete. That delay gives defenders fewer obvious indicators and gives attackers more time to blend persistence into normal system behaviour.

Q: What signs suggest a scheduled task is being used for persistence?

A: Suspicious signs include SYSTEM-level tasks created from user-writable paths, tasks that launch scripts or interpreters, and task names that mimic normal system functions. If the task appears soon after a freeware install or launches Node.js, PowerShell or temp-file content, treat it as a persistence event rather than maintenance noise.

Q: How should teams respond to proxyware on managed endpoints?

A: Treat proxyware as unauthorised software with potential to sit inside a broader compromise chain, not as a harmless nuisance. Contain the host, remove the persistence mechanism, verify whether the installer brought in additional scripts or tasks, and review whether the same pathway could be used to deliver more dangerous payloads later.

Technical breakdown

How download cradles hide execution in memory

A download cradle is a script that retrieves a second-stage payload from a remote location and immediately executes it, often with a pipe to Invoke-Expression or an equivalent runner. That means the malicious content may never be written to disk, which weakens file-based scanning and raises the importance of script content, parent-child process chains and command-line telemetry. In this case, the first PowerShell command used a web request to fetch a remote script and then executed it in the current PowerShell session. Because the chain stays in memory, the observable footprint shifts from files to process behaviour, network destinations and encoded command structure.

Practical implication: Treat in-memory execution as a telemetry problem, not just a malware problem, and inspect script launch context plus remote fetch behaviour.

Why hidden scheduled tasks create delayed persistence

Scheduled tasks are often used for benign automation, but attackers can use them to defer execution, blend into normal service activity and wait for a later command from a C2 server. In this incident, the initial script staged Node.js and JavaScript, then created a SYSTEM-level task that checked in hourly until the later PowerShell payload arrived. That delay matters because it separates the initial compromise from the visible malicious behaviour, reducing the chance that defenders correlate the install event with the later payload. When a task runs under SYSTEM, it also inherits a high-trust execution context that expands what the attacker can do once the task fires.

Practical implication: Review newly created SYSTEM tasks as persistence events, not routine automation, and tie them back to the original installer chain.

How proxyware turns endpoint control into monetised abuse

Proxyware is software that shares endpoint bandwidth with a third party in return for payment, but in threat activity it becomes an unauthorised monetisation layer running on a compromised host. The risk is not only the proxyware itself. Once an attacker can install and schedule payloads with elevated rights, the same foothold can support later malware delivery, additional tooling or further abuse. The article shows that the final payload was installed only after a staged wait, which is a common pattern in abuse chains that try to reduce early detection. The technical concern is less about a single unwanted application and more about durable control of the endpoint.

Practical implication: Block unauthorised software installs and elevated task creation so monetisation tooling cannot become a stepping stone to broader compromise.

Threat narrative

Attacker objective: The attacker sought to install proxyware on compromised endpoints and monetize the host while preserving the option to deploy more dangerous code later.

1. Entry began when a user installed a freeware disk-cleaning utility that bundled a hidden PowerShell script.
2. Credential access was not the main issue here, but the initial script established SYSTEM-level scheduled-task persistence and a recurring C2 check-in.
3. Escalation occurred when the C2 server later delivered a PowerShell download cradle that ran in memory and fetched the proxyware payload.
4. Impact was the attempted installation of proxyware on the endpoint, with the same foothold capable of supporting additional payloads later.

NHI Mgmt Group analysis

Living-off-the-land execution has become a persistence problem, not just an evasion problem. This case depends on trusted tools such as PowerShell, CMD, Node.js and scheduled tasks to move the attack forward without obvious malware files. That shifts the governance question from binary detection to execution authority, script control and service-context abuse. Practitioners should treat local scripting surfaces as part of the endpoint trust model, not as harmless admin convenience.

Delayed detonation is the real control gap here. The initial install did not immediately trigger the proxyware payload, which allowed the attacker to create a quiet waiting state and return later with a second-stage command. That pattern defeats control assumptions built around a single install event or a single suspicious process. The named concept is staged endpoint abuse, where benign installation and malicious execution are intentionally separated in time. Practitioners should design monitoring to join those phases together.

Proxyware is a monetisation vector that can sit inside broader compromise chains. The article shows why organisations should not dismiss proxyware as merely unwanted software. Once SYSTEM-level persistence exists, the same endpoint can be repurposed for proxy traffic, malware staging or lateral deployment. That means software policy, endpoint hardening and behavioural detection all need to account for what an attacker can do after the first non-consensual install.

The identity lesson is about control of execution context, not just user authentication. The attack did not rely on stolen user credentials, but it did rely on trusted execution paths, elevated scheduled-task context and the ability to act with system authority. In NHI terms, the same principle applies to service accounts and workload identities: if execution context is too broad, the resulting blast radius is too. Practitioners should align endpoint control with privilege containment across both human and machine execution paths.

What this signals

Staged endpoint abuse is the best way to understand this incident. The first install created persistence and a callback path, then the final payload arrived days later when monitoring likely had less context. Teams should build detections that correlate installation, task creation and script execution across time rather than treating each event as isolated noise.

For practitioners, the main change is that application control and task governance need to be evaluated together. Blocking one script path is not enough if a freeware installer can still plant a recurring SYSTEM task that awaits a later command. The control objective is to stop the quiet staging phase before it becomes an execution channel.

For practitioners

• Restrict PowerShell to authorised administration paths Limit PowerShell execution on user endpoints, require signed or approved scripts where feasible, and record the command line and parent process for every suspicious invocation.
• Tighten scheduled-task governance Alert on new SYSTEM-level tasks, especially those that launch scripts, Node.js or unusual binaries from user-writable locations or temp paths.
• Block unapproved software installs Use application control to prevent freeware installers and bundled scripts from introducing hidden persistence or unsigned payloads onto managed endpoints.
• Correlate initial install events with delayed execution Join software installation telemetry, script execution logs and scheduled-task creation so a quiet first stage can be linked to a later malicious payload.

Key takeaways

• This incident shows how a benign-looking freeware install can become a staged persistence mechanism that later delivers in-memory PowerShell execution.
• The defender-visible trigger was not the first install but the later callback and payload launch, which is why correlation across time matters.
• Restricting PowerShell, governing scheduled tasks and blocking unapproved software installs would have sharply reduced the attacker's room to manoeuvre.

Key terms

• Download Cradle: A download cradle is a script or command sequence that fetches code from a remote source and executes it immediately, often without writing a file to disk. Attackers use it to reduce forensic evidence and bypass file-centric detection, especially when trusted tools like PowerShell are involved.
• Scheduled-Task Persistence: A condition where an AI agent creates or modifies recurring automation that continues after the original interaction. It matters because a one-time injection can become durable influence, making later actions look legitimate even though the underlying instruction was attacker-shaped.
• Living-off-the-Land: Living-off-the-land attacks use legitimate enterprise tools instead of custom malware. In identity environments, that means abusing approved administrative functions to perform disruptive actions while blending into normal operational traffic.
• Proxyware: Proxyware is software that shares a device's internet bandwidth with third parties, sometimes in exchange for payment. In hostile campaigns it becomes unauthorised monetisation software that can be installed without consent, creating both abuse and broader compromise risk when attackers retain control of the host.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is suitable for security teams that need a stronger governance lens across human and machine access paths.