3 ms·

So far I've got: Download a movie --> Magic Happens --> Powershell --> Firefox compromised! --> We infected your torrents! --> Ah, found your crypto. --> Your

• Dylan16807 8y ago
  Based on the tweets, step two is that the "movie" is actually a shortcut file. The shortcut runs powershell with a short obfuscated command that downloads the malware payload. Then it does a variety of normal malware stuff.
• rasz 8y ago
  except there is no movie