V
Tracker only
Volt
ScriptBlox records 100% sUNC and a rebrand from AWP.GG. A Triage score of 7/10 is the only independent signal.
potassium — distribution modules
sUNC 100%
Triage 6–7/10
Discord-gated
Function coverage
86/86
sUNC 100%. UNC 99% . ScriptBlox records the same score against version 2.5.3, tested on version 2.1.5 three months before the October check .
- 86 standard functions pass
- 14 libraries tested
- Test run: 27.8 seconds
Distribution
Discord
Purchase → register → PSM bot →
download command → credentials → file delivered in Discord . No public download page exists.- No website hosts the binary
- Discord bot is the delivery mechanism
- Login required after launch
Independent sandbox
6–7/10
Triage scored
Potassium Executor.zip at 7/10 and Potassium-Executor_246273.exe at 6/10 . Behavioral flags: dropped EXE execution, network share discovery, COM hijacking .- Dropped EXE execution
- Network share discovery
- COM object hijacking persistence
Detection status
Detected
ScriptBunker marks the build Detected. ScriptBlox notes a banwave on June 1st and says the exploit "could be detected" .
- Detection is a ban-risk signal
- Not a malware classification
- ScriptBunker: "not marked detected is not a guarantee of safety"
Kernel-level injection
Kernel
ScriptBlox notes that Potassium uses kernel-level injection. After use, you need to restart your PC before playing games with kernel-level anti-cheat. Rare BSODs and memory errors are possible .
- Requires restart after use
- Kernel-level attack surface
- ScriptBlox: "use Windows 11 for best experience"
Domain confusion
.app
potassium.pro links to the official Discord for purchase . A separate domain, potassiumexecutor.app, is flagged by Gridinsoft with a 26/100 trust score and two blacklist hits . They are not the same source.- potassium.pro → Discord
- potassiumexecutor.app → flagged
- Two domains, two reputations
Sources: ScriptBlox Potassium · ScriptBunker Potassium · NamuWiki Potassium · Triage samples 260524-yasnmaet9q and 260512-rf38zsh12j . The Triage score is behavioral, not a malware verdict.
What a Discord delivery channel actually proves
A Discord bot is a delivery mechanism, not a verification mechanism. When you run the download command and receive a file, you have a file. You do not have a signed binary, a reproducible build, or a public hash you can compare against. The channel proves that the developer controls the bot. It does not prove that the file the bot sends matches the file the developer intended to build.
NamuWiki describes the process precisely: purchase, register, use the PSM bot with your ID and password, then launch and log in again . That is a closed loop. There is no public artifact to inspect before you buy, and no public artifact to inspect after you receive it. The only inspection point is the file on your disk.
This is not unique to Potassium. It is the standard model for paid executors that do not want their binaries mirrored or redistributed. The trade-off is explicit: the developer retains control over distribution, and the buyer loses the ability to compare the delivered file against a public reference.
What the Triage scores add
Triage is a public sandbox. It observed two Potassium samples and scored them 6/10 and 7/10 . The behavioral flags are specific: dropped EXE execution, network share discovery, COM object hijacking for persistence, and system language discovery . These are not generic warnings. They are behaviors the sandbox recorded.
A 6/10 or 7/10 score is not a malware classification. It is a behavioral signal. Some of those behaviors are consistent with a legitimate installer that needs to query system state. Others, like COM hijacking for persistence, are more commonly associated with malware. The score does not resolve the ambiguity. It gives you a starting point that does not come from the executor's own documentation.
The two domains, compared
Two domains use the Potassium name. They are not the same source, and they do not have the same reputation. This table separates them.
| Domain | What it does | Reputation signal |
|---|---|---|
potassium.pro |
Landing page with Purchase and Discord buttons that link to discord.gg/potassium |
No independent scan data found |
potassiumexecutor.app |
Claims to offer a download for "Potassium Executor" | Gridinsoft: 26/100 trust score, 2 blacklist hits, domain registered February 2026 |
The existence of a flagged domain does not mean the project is malicious. It means the name is being used by more than one source, and the sources have different reputations. The official Discord is the only delivery channel described by NamuWiki and ScriptBlox.
What this page does not claim
- This page does not claim Potassium is malware. Triage scores of 6/10 and 7/10 are behavioral observations, not malware classifications.
- This page does not claim the Discord bot delivers a safe file. The channel is controlled by the developer. It is not an independent audit.
- This page does not claim
potassium.prois safe. It is described here because it links to the official Discord. No independent scan of that domain was found. - This page does not claim the 100% sUNC score is a safety rating. It measures function coverage. It does not inspect the loader.
Potassium questions, separated from the sales page
Why is Potassium only available through Discord?
NamuWiki describes the process: purchase, register, use the PSM bot in the official Discord with the download command, enter your ID and password . The developer retains control over distribution. There is no public download page and no public hash to compare against.
What does kernel-level injection mean for my PC?
ScriptBlox notes that Potassium uses kernel-level injection. After using it, you need to restart your PC before playing games with kernel-level anti-cheat. Rare BSODs and memory errors are possible . This is a stability and attack-surface consideration, not a malware verdict.
What did Triage actually observe?
Two samples, scored 6/10 and 7/10. Behavioral flags include dropped EXE execution, network share discovery, COM object hijacking for persistence, and system language discovery . The scores are behavioral signals, not malware classifications.
Is potassiumexecutor.app the official site?
No verified evidence connects it to the developer. Gridinsoft assigns it a 26/100 trust score with two blacklist hits . The official delivery channel described by NamuWiki and ScriptBlox is the Discord server, not that domain.
Does 100% sUNC mean the file is clean?
No. sUNC measures function coverage. It runs inside the Lua environment and reports which functions work. It does not inspect the loader, the installer, or the Discord bot that delivers the file.
Why does this page look different from Volt's?
Because the evidence is shaped differently. Volt had a rebrand and a Triage score. Potassium has a distribution model that never touches a public page, a kernel-level injection note, and two domains with different reputations. The layout uses six independent modules so each of those facts sits in its own container, rather than forcing them into a single narrative.
Related profiles
W
Tracker only
Wave
ScriptBlox records 100% sUNC and a team change from 2025. Four signals, four different questions.
X
Campaign documented
Xeno
A public GitHub repository and a Bitdefender report. The profile compares the loader the repository describes with the loader the fake installer replaced.