This script will stole target ProtonVPN config file. Opens PowerShell hidden, grabs ProtonVPN config file, saves as a cleartext in a variable and exfiltrates info via Discord Webhook. In the config file you can find a lot information about the user like: UserUid UserAccessToken UserRefreshToken UserAuthenticationPublicKey UserAuthenticationSecretKey UserAuthenticationCertificatePem UserCertificationServerPublicKey and so on... Then it cleans up traces of what you have done after.
Exfiltration is an involuntary backup. It's a technique for obtaining data from a network. Once obtained, the data may be removed using a number of methods. These may include traversing the network to a command and control server, such as Cloud C². The content is typically encrypted or obfuscated. In the case of physical access, a bring-your-own-network element may be included to evade detection. See all exfiltration payloads.
This payload is for the USB Rubber Ducky — a "flash drive" that types keystroke injection payloads into unsuspecting computers at incredible speeds. It's no wonder this little quacker has made appearances on Mr. Robot, FBI, Blacklist, National Geography and more!