Obfuscated Inline Script Execution

Tim Peck@timpeck

•updated Mar 9, 2026•5•0•158

Detects Node.js or Python processes executing highly obfuscated or large inline expressions via the '-e' (Node.js) or '-c' (Python) flags. This technique is a primary execution method for stagers associated with North Korean APTs, such as DEV#POPPER and OmniStealer, which are often hidden in legitimate-looking configuration files.