Operation SilentCanvas hides malware in fake JPEG files, using PowerShell to silently infect Windows systems.
  • NickeeCoco@piefed.socialEnglish
    0·
    3 months ago

    The embedded PowerShell code creates a hidden folder at C:\Systems and downloads a trojanized ScreenConnect package from legitserver.theworkpc[.]com over TCP port 5443.

    Nothing to see here, just a legit server doing work with the systems.