TONResolver PowerShell Downloading Node.js Runtime to AppData\Local\Nodejs

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects the TONResolver RAT infection chain, where PowerShell is used to download the Node.js runtime to a non-standard directory under AppData\Local\Nodejs, followed by the execution of a JavaScript payload. This behavior is associated with campaigns utilizing Cloudflare-proxied (.cfd) domains to distribute malicious components.