TONResolver Silent Node.js Install and JavaScript RAT Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects the execution of a malicious Node.js payload by the TONResolver malware. The rule monitors for the execution of node.exe from a specific path within the user's AppData directory (AppData\Local\Nodejs\node-v24.13.0-win-x64\) when accompanied by a JavaScript file argument, indicating the execution of a remote access trojan (RAT) script.