diff --git a/runster/20260605_Runster_malwarecampaigns.md b/runster/20260605_Runster_malwarecampaigns.md
index ed65d3e..5dfd09f 100644
--- a/runster/20260605_Runster_malwarecampaigns.md
+++ b/runster/20260605_Runster_malwarecampaigns.md
@@ -1,4 +1,8 @@
 
+Update:
+Payload C is probably tied to MetaStealer and was recently detailed by Huntress (which named it Potemkin loader).
+
+
 
 Orange Cyberdefense has been tracking a previously unnamed modular stealer+loader framework we call #Runster, active since at least November 2025.