TONResolver: node.exe AppData Cookie Theft Following PowerShell -ep bypass Dropper

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the correlation of a PowerShell process spawned by Explorer using a bypass execution policy, followed by a local Node.js process accessing web browser cookie files (Chrome, Edge, or Brave). This behavior is indicative of a potential credential theft attempt where an attacker uses PowerShell to prepare the environment and a helper process to extract browser session cookies.