Notifications
Clear all
Topic starter
20/08/2026 5:45 pm
TL;DR: A suspicious PowerShell chain used a download cradle, in-memory execution, and SYSTEM-level scheduled tasks to install proxyware, with the infection traced back to a freeware disk-cleaning utility bundled with malicious scripts, according to Expel. The incident shows how living-off-the-land tools and delayed C2 tasking can hide persistence long enough to turn a benign install into controllable endpoint abuse.
NHIMG editorial — based on content published by Expel: LLMjacking: How Attackers Hijack AI Using Compromised NHIs
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected.
- Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months.
Questions worth separating out
Q: How should security teams handle suspicious PowerShell chains on Windows endpoints?
A: Treat them as an execution-chain problem, not a single-alert problem.
Q: Why do scheduled tasks create persistent risk when paired with user-installed software?
A: Because they let untrusted code reappear under a trusted context after the original install looks complete.
Q: What do teams get wrong about proxyware and similar grey-area software?
A: They assume the issue is only nuisance bandwidth use.
Practitioner guidance
- Restrict PowerShell execution on user endpoints Limit interactive PowerShell use to approved administrative roles and enforce constrained language or execution-policy controls where appropriate.
- Block unapproved software installation paths Use application control such as AppLocker or Windows Defender Application Control to prevent freeware installers and bundled scripts from introducing persistent execution chains.
- Audit scheduled tasks and service creation for SYSTEM context Look for hourly tasks, renamed service binaries, and tasks that run under SYSTEM without a clear business owner or support ticket.
What's in the full article
Expel's full blog covers the operational detail this post intentionally leaves for the source:
- Full process tree and command-line breakdown of the PowerShell download cradle used in the intrusion.
- Indicator details for the scheduled tasks, paths, and hashes associated with the staged payloads.
- IOCs for the bundled freeware installer, JavaScript stage, and proxyware executable path.
- Step-by-step defensive recommendations for PowerShell logging, application control, and endpoint containment.
👉 Read Expel's analysis of a proxyware infection chain using PowerShell →
Proxyware installs through hidden startup tasks: what should defenders watch?
Explore further
20/08/2026 6:27 pm
Software installation governance is now a hidden identity control. The attack began as a user-driven install, but the real risk was the creation of privileged execution paths that outlived the original application. When users can introduce tasks, services, and scripts that later run in SYSTEM context, endpoint governance becomes part of identity governance. Practitioners should treat software allowance, script control, and privilege scoping as one control plane, not separate concerns.
A question worth separating out:
Q: What should defenders do before a staged PowerShell payload completes?
A: Isolate the endpoint as soon as the chain shows scheduled persistence and remote command retrieval. That breaks the attacker’s ability to deliver the final executable, prevents follow-on task creation, and gives investigators a cleaner timeline for containment and root-cause analysis.
👉 Read our full editorial: Proxyware installs through in-memory PowerShell and hidden startup tasks
