Search — “microsoft.exe”

Dr. Web reports a two-year campaign using malicious GitHub repositories (now posing as security tools such as an Fscan output parser, earlier as crypto and game tools) with code hidden behind whitespace in Visual Studio pre-build events, Python and Go files. PowerShell retrieves an encrypted link to an Electron loader 'Microsoft.exe' that persists, elevates, disables Smart App Control, unhooks ntdll, patches ETW and AMSI, adds Defender exclusions and injects into RegAsm.exe. Payloads are AsyncRAT, a crypto clipper and an infostealer that exfiltrates via a Telegram bot; Dr. Web says more than 2,000 Windows systems were compromised. Hunt for MSBuild or Visual Studio pre-build events spawning PowerShell, Microsoft.exe running outside system paths, RegAsm.exe making network connections, Defender exclusion changes and AV uninstall attempts.