The Hacxx PowerShell Cozy Bear Downloader Exploit is a malicious tool that generates PowerShell code to download files and execute them. It was created by an individual known as Hacxx.

This exploit is associated with the notorious Cozy Bear hacking group, which is believed to be backed. Cozy Bear has been involved in various cyberattacks, including supply chain attacks that targeted both public and private organizations. In one such incident, approximately 18,000 organizations worldwide unknowingly downloaded network management tools containing a backdoor planted by Cozy Bear.