This campaign involves suspicious PowerShell content served from an IP address (203.188.171.166) and domain (dorenzaa.com), both hosted on Vercel infrastructure. The PowerShell loaders extract and execute multiple payloads locally. Analysis shows multiple obfuscation layers including Base64 encoding, XOR-based obfuscation with the key 'Write', and dynamically constructed IEX commands to hide execution. A decoy message is presented to victims to mask malicious activity. Multiple Vercel instances host additional loader scripts and executables. The initial infection vector remains unidentified, suggesting these URLs are second-stage delivery points in a multi-stage attack chain.

The campaign enables execution of multiple payloads on victim systems through obfuscated PowerShell loaders, potentially allowing attackers to deploy malicious executables locally. The obfuscation and decoy messaging complicate detection and analysis. The initial infection vector is unknown, which limits understanding of full attack scope. No known exploits in the wild have been reported for this campaign at this time.

No official patch or fix is applicable as this is a multi-stage loader campaign rather than a software vulnerability. Defenders should block or monitor access to the identified domains and IP addresses (e.g., dorenzaa.com and 203.188.171.166) and investigate any PowerShell execution involving the described obfuscation techniques and payload hashes. Since the initial infection vector is unknown, focus on detection and containment of the second-stage payload delivery is recommended.