At this point, we’ve finally made into the string of code that is passed into PowerShell. This does a few checks to ensure the payload being used for the target is appropriate.

Attackers looking to steal employee credentials from organizations tied to the industrial sector deployed highly-targeted operations that delivered malicious PowerShell scripts in images.