On: Windows PowerShell Phish Has Scary Potential

[nullindividual]

That confirms it is an Invoke-WebRequest (with some other PS script bits to confirm they're on a physical machine returning a valid temp via WMI).