EvilAi Node.js Malware CMD Execution for System Information Discovery

Adair Collins@ajc

•updated Nov 21, 2025•39•6•735

Detects suspicious behavior where a Node.js-based application, potentially EvilAi malware, launches cmd.exe to query MachineGuid from the registry or system model via PowerShell. This activity indicates potential fingerprinting or persistence activity, often originating from the \AppData\Local\Programs\ directory with medium integrity.