TonRAT Photo ZIP ClickFix: LNK Spawning PowerShell then node.exe

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

This rule detects potentially malicious process chains involving PowerShell and Node.js. It specifically flags cases where PowerShell launches PowerShell or Node.js with command lines containing suspicious file patterns (e.g., .lnk masquerading as images) or when Node.js is executed from PowerShell in user-writable directories (e.g., AppData, Temp) with command lines referencing known malicious domains.