Hidden PowerShell spawned by cplsupport.exe (HiveMQ backdoor)

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•0

Detects execution of PowerShell.exe initiated by cplsupport.exe with hidden window styles and non-interactive, no-profile flags, which is often indicative of obfuscated command execution or malicious script activity.