PowerShell Downloading from jsdelivr

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•4

Detects PowerShell downloading payloads from cdn.jsdelivr.net, which has been associated with malware like ClearFake.