TookPS: DeepSeek isn’t the only game in town

Kaspersky telemetry uncovers a widespread campaign using TookPS downloader distributed via fraudulent/pirated software websites; the downloader retrieves PowerShell scripts that install an SSH server (sshd.exe) to create a remote tunnel and subsequently deploy backdoors (TeviRat, Lapmon) via techniques including DLL sideloading. The report provides IOCs (MD5s, domains, URLs, IPs), describes the infection chain and attacker capabilities, and recommends avoiding pirated software and enforcing security policies and user training.