JustAskJacky
JustAskJacky is a family of malicious NodeJS applications that masquerade as helpful AI tools or utility applications while performing undisclosed malicious activity in the background. It is described as a trojan horse because the lure application typically retains the advertised functionality and can return results to the user, while also conducting reconnaissance and executing arbitrary commands in memory on the victim system. Red Canary tracks this malware family under multiple lure names, including AllManualsReader, AskBetty, and HowManualReader. JustAskJacky is typically introduced through seemingly legitimate online installers for AI or utility tools. For persistence, installers create scheduled tasks using schtasks.exe in the AppData directory. The malware communicates with remote command-and-control infrastructure using DGA-like domains. Observed samples have also shown evidence of cryptomining code being delivered and executed in memory. Detection opportunities specifically mentioned include monitoring for scheduled task creation in AppData via schtasks.exe. The content states that JustAskJacky was the most prevalent threat observed in October 2025.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
JustAskJacky is a family of malicious NodeJS applications that disguise themselves as AI or utility tools, performing reconnaissance and executing arbitrary commands in memory.
Family of malicious NodeJS applications that masquerade as helpful AI or utility tools while conducting reconnaissance and executing arbitrary commands in memory in the background. It establishes persistence via scheduled tasks and can receive and execute arbitrary JavaScript from its C2, including cryptomining payloads.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.