TookPS is a PowerShell downloader used as the initial payload for OkoBot. It has been active since March 2025, delivered via fake DeepSeek pages and trojanized software. It establishes SSH tunnels and deploys additional malicious modules.
TookPS is a PowerShell downloader used as the initial payload for OkoBot. It has been active since March 2025, delivered via fake DeepSeek pages and trojanized software. It establishes SSH tunnels and deploys additional malicious modules.