PowerShell has always had two reputations. To an attacker, it’s a scripting engine that’s pre-installed on every Windows box, trusted by default, and powerful enough to download, decode, and execute a second-stage payload without ever writing a traditional executable to disk. To a defender, it’s the same engine — and increasingly, via the Microsoft Graph SDK, the fastest way to query Entra ID sign-in logs, risk detections, and account hygiene at scale.

The attacker side: a payload that doesn’t even bother with real steganography

On August 24, 2026, Didier Stevens published “DOUBLECUP’s PNG Payload”, describing a delivery trick used by DOUBLECUP, a “ClickFix”-style loader campaign. ClickFix attacks are the now-familiar pattern where a fake CAPTCHA, error dialog, or “verify you’re human” prompt talks a user into opening the Windows Run dialog and pasting in a command themselves — the payload never has to survive a browser download scan, because the victim types the loader in by hand.

What Stevens flags is what happens next: how the PowerShell stage actually gets hidden. DOUBLECUP takes a perfectly valid PNG image and appends a PowerShell script directly after the end of the image data. The file still opens fine in any image viewer — nothing about the PNG itself is broken. The trick is in one small detail: the appended script begins with the two bytes 0x0D 0x0A (carriage return + line feed), which is simply how a line ends in Windows text. That’s enough for the attacker to skip building any custom extraction tool. A single findstr call — the Windows-native equivalent of grep — searches the file for a unique marker string, and whatever comes back can be piped straight into powershell for execution. No parser, no image library, no bespoke unpacking code. Just a built-in utility chaining into another built-in utility.

Stevens is candid that this isn’t sophisticated: the payload “has not been encoded into the pixels of the image,” and he pointedly notes it doesn’t qualify as “real steganography” — it’s concealment by convenience, not by design. That’s arguably the more useful takeaway for defenders than if it had been clever: this technique works because it leans entirely on tools already sitting on every Windows machine, not because it’s hard to detect once you know to look. A file that’s larger than a valid PNG “should” be, or that has readable script text sitting after the last image chunk, is a fairly blunt tell — if you’re inspecting file structure at all.

That single technique sits inside a much larger, well-worn category of malicious PowerShell behavior that shows up across most living-off-the-land campaigns, DOUBLECUP included:

  • Download cradles — one-liners like IEX (New-Object Net.WebClient).DownloadString(...) that fetch and immediately execute a remote script, leaving no file on disk.
  • Encoded/obfuscated commands — -EncodedCommand (or -enc) followed by a Base64 blob, specifically to defeat simple string-matching on the command line.
  • Stacked evasion flags — -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -NonInteractive appearing together is a combination almost no legitimate admin script needs all at once.
  • LOLBin chaining — using trusted native binaries (findstr, certutil, bitsadmin, mshta) to stage, decode, or fetch a payload before PowerShell ever touches it, exactly as DOUBLECUP does with findstr.
  • Payloads riding inside “boring” file types — appended to images, hidden in alternate data streams, tacked onto the end of PDFs or archives — anywhere a file-type check based on extension or magic bytes alone won’t look past the part of the file that’s supposed to be there.

The defender side: the same story, told from the identity logs

The other four diaries, all written by Rob VandenBrink over August 20–21, 2026, aren’t about attacker tradecraft at all — they’re a short course in using PowerShell and the Microsoft Graph SDK to pull identity signal out of Entra ID that most organizations never look at. That distinction matters: these aren’t examples of malicious PowerShell, they’re examples of PowerShell as the investigative tool defenders reach for once something like a ClickFix loader has already landed and started acting on stolen credentials.

Risky sign-ins. “Using Microsoft Graph and PowerShell — Risk Detection Commands” walks through Connect-MgGraph -Scopes "IdentityRiskyUser.Read.All","IdentityRiskEvent.Read.All" followed by Get-MgRiskDetection -All, filtered down to detections that haven’t already been dismissed or remediated. The examples VandenBrink pulls out are exactly the shape of activity that follows a successful credential-stealing payload: logins flagged UnfamiliarDevice, UnfamiliarTenantIPsubnet, and sign-ins from geographically scattered locations — Malaysia, Colombia, South Korea, Warsaw — that no single traveling user plausibly produced.

Password spray and impossible travel. “Even MOAR PowerShell, looking at Entra logins — the good, the bad and the password sprays” goes straight at Entra sign-in logs with Get-MgAuditLogSignIn, first isolating failed logins (status/errorCode ne 0) to surface password-spray patterns — clusters of failures across many accounts, often from rotating proxy IPs and, notably, IPv6 addresses — then flipping to successful logins to catch the ones that came from outside an expected country allowlist. VandenBrink’s own conclusion is blunt: organizations that carefully monitor on-prem logs routinely leave their cloud sign-in logs unread, and doing this pass surfaced active password-spray campaigns he didn’t know were running.

Accounts that skipped MFA. “Who Got Missed in the MFA Rollout? More PowerShell + Graph + Entra scripting!” uses Get-MgBetaReportAuthenticationMethodUserRegistrationDetail -All to find every account where IsMfaRegistered is still $false — the accounts an MFA rollout quietly missed, and exactly the accounts most exposed if a ClickFix-style prompt talks a user into handing over a password.

Dead accounts and dead licenses. “Using Microsoft Graph and PowerShell to Mine for Information — Stale Accounts and Licenses” is the housekeeping piece: Get-MgUser -All joined against Get-MgUserLicenseDetail to find accounts that are disabled, long-dormant, or still holding a license nobody’s using. Dormant-but-enabled accounts are a quiet liability — they’re rarely watched, and a spray or credential-stuffing attempt that lands on one can sit unnoticed far longer than on an account someone actually uses every day.

Why the pairing matters

None of VandenBrink’s four diaries mention malware. But line them up against Stevens’ DOUBLECUP writeup and the sequence is obvious: a user gets ClickFix’d into pasting a PowerShell one-liner, that script pulls a stage hidden after a PNG’s pixel data using nothing but findstr, and whatever runs next goes looking for credentials or session tokens. The moment those credentials get reused, they surface as exactly the signals the Graph queries above are built to catch — a login from a device or subnet that’s never been seen, a burst of failures that looks like a spray, a successful sign-in from a country nobody on that account has ever traveled to, or activity on an account that was supposed to be dormant.

The practical read for a security team: the file-inspection side and the identity-log side are catching two different moments of the same intrusion, and neither one alone tells the whole story. A payload built to slip past a naive “is this a PNG” check is a delivery-stage problem; an unfamiliar-device sign-in three hours later is a post-compromise problem. Teams that only watch one side get half the picture — which is as good an argument as any for treating “what’s actually inside this file” and “who’s actually behind this login” as two questions worth asking together, not in sequence, whenever a security review comes up short.

References: