Decoded scripts drop a randomized 7‑Zip, extract payloads, create scheduled‑task persistence and Defender exclusions, exfiltrate data and deploy Lumma Stealer to harvest browser credentials.
Part of the PlainSec briefing for 2026-03-07