Photo ZIP ClickFix LNK Spawning PowerShell to Stage TonRAT Node.js Implant
Detects the execution of malicious LNK files (masquerading as image files) that trigger PowerShell scripts, or the subsequent execution of non-Microsoft signed Node.exe binaries from suspicious directories, characteristic of the TonRAT campaign.
SentinelOne
