I do not understand how this works. I thought the default PS policy on all versions of Windows was not to run "unsigned" PS scripts by default (precisely for this reason). Or at least I've personally seen that a myriad times.

So, are these malware scripts signed, has MS relaxed the default PS policy, do users relax it, or has this malware found another way around it?