TONResolver: node.exe Spawned from Suspicious Parent Executing JS RAT Payload

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the execution of node.exe from unusual parent processes and suspicious locations like AppData, Temp, or user-writable profile folders. This behavior is indicative of the TONResolver RAT, where node.exe is utilized to execute malicious JavaScript payloads disguised as legitimate processes.