TONResolver: Browser/Email → PowerShell (Encoded/Bypass) → node.exe/wscript.exe Chain

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects instances where a browser or email client spawns a PowerShell process containing common obfuscated command-line arguments (e.g., -enc, IEX, bypass), which then subsequently executes node.exe or wscript.exe. This pattern is characteristic of the TONResolver infection chain, where a phishing lure triggers initial code execution via browser or email client to deploy a JavaScript-based RAT.