Malicious SuperHidden Files Suppression via Immediate Explorer Refresh

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects a process atomically disabling the display of protected operating system files in Explorer and immediately forcing all open Explorer windows to reflect the change, without requiring user interaction or an Explorer restart by the user. This two-step pattern is used by malware to ensure that dropped files and persistence artifacts become invisible across all open folder windows the instant they land on disk, closing the window where a victim might otherwise still see them in a pre-existing Explorer window.

2026-11-03 00:00:00

None

49c4a6ff-033c-4dcd-85e8-9d64dda715bc

attack.stealth attack.t1564.001

Nextron Sigma feed only (private)