JavaScript dropper instantiates ActiveXObject for shell/filesystem access

Renata Cardoso@rcardososec

•updated Aug 10, 2026•1•0•1

Detects JavaScript dropper stage instantiating ActiveXObject('WScript.Shell'), ActiveXObject('Scripting.FileSystemObject'), or ActiveXObject('Shell.Application') to gain filesystem and shell command execution access, executed via wscript.exe/cscript.exe