A threat actor is using a PowerShell ... MAR26', which contained a malicious shortcut file (.LNK). Accessing the shortcut file triggered PowerShell to run a remote script.

The PowerShell script also contains routines to infect clean Word and Excel documents with the malicious CRIGENT code, making the threat a self-propagating computer worm. The combined use of Tor ...

Threat actors took advantage of this development, using fake but verified Ross Ulbricht accounts on X to direct people to malicious ... and executes a PowerShell script, which eventually downloads ...