Scheduled task 'GoogleUpdateService' persists embedded Python via Schedule.Service COM

Duo Tech@duotech

•updated Aug 4, 2026•4•0•6

Detects CountLoader creating a scheduled task named GoogleUpdateService<GUID> via the Schedule.Service COM object to run an embedded Python environment (App.py) every 25 minutes, masquerading as a legitimate Google Update task.