JunkFiction Trojanized Installer Delivery (Interlock)

Ibrahim Saud@tektrix

•updated Jun 18, 2026•0•0•7

Detects the use of PowerShell with 'Invoke-WebRequest' to download trojanized installers (MicrosoftEdgeSetup.exe, ChromeSetup.exe, MSTeamsSetup.exe) from malicious domains like 'apple-online.shop' or 'trycloudflare.com', as observed in Interlock activity leveraging JunkFiction.