TONResolver PowerShell-to-Node.js RAT Execution Chain

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects a multi-stage infection chain associated with the TONResolver campaign where PowerShell is used to execute a Node.js-based RAT payload from a non-standard location in AppData\Local\Nodejs. This pattern monitors for the parent-child relationship where PowerShell launches a specific node.exe instance containing JavaScript file execution flags.