Deno Execution via Data URI

Elgonad .@elgonad

•updated Mar 20, 2026•2•1•58

Detects the Deno runtime executing base64-encoded payloads via data URIs. This technique is used by threat actors, such as LeakNet, to run JavaScript payloads directly in memory, evading traditional file-based detection.