Conhost Headless Executing Node.js

nomit vyas@xoxo

•updated Jun 24, 2026•5•0•7

Detects the execution of Node.js silently using 'conhost --headless', a technique used by EtherRAT and other malware to run malicious JavaScript payloads without displaying a console window to the user.