As a "corporate" sysadmin using Powershell everyday, I was always surprised that PS is not so used in the malware industry.

By the way, I find that this article[0] linked in the original post is much more interesting if you want to know more about how brazilian malwares work (BHO injection, 2FA bypass, etc.)

[0] https://securelist.com/blog/research/74325/the-evolution-of-...