As an open-source tool, it has been used by several state-backed espionage actors like the Iranian APT33 and APT35 groups, as those tools make attribution and persistent operation harder to track.

Fake IT support sites promote malicious PowerShell "fixes" for common Windows errors, like the 0x80070643 error, to infect devices with information-stealing malware. First discovered by eSentire's ...