TaskWeaver dropping Djinn Stealer as second-stage payload via Node.js

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•6

Detects execution of Node.js processes associated with the TaskWeaver JavaScript loader. The rule monitors for unauthorized Node.js processes (lacking official publisher signatures) spawning secondary processes or executing specific suspicious command lines linked to TaskWeaver and Djinn Stealer activity, such as loading obfuscated jquery.js or accessing configuration files associated with credential theft.