Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
С ноября 2025 года для доставки ABCDoor злоумышленники стали использовать JavaScript-загрузчик... run_direct.ps1 проверял наличие NodeJS... затем он запускал файл run.deobfuscated.obf.js.
8 distinct techniques documented for this family, organized by ATT&CK tactic.
“Script hosts are an ideal target for a reputation hijacking attack. This is especially true if they include a foreign function interface (FFI) capability. With FFI, attackers can easily load and execute arbitrary code and malware in memory.”
Exécution d’un JavaScript obfusqué ( DdkExG1tIy.ini ) par le runtime Node.js
Detection logic looks for APIs including “VirtualProtect*, WriteProcessMemory, VirtualAlloc*, MapViewOfFile*” with behaviors such as “shellcode,” “allocate_shellcode,” “execute_shellcode,” and “unbacked_rwx.”
“Reputation hijacking involves finding and repurposing apps with a good reputation to bypass the system.” The article identifies trusted script hosts and utilities including Lua, Node.js, AutoHotkey, and JamPlus that can be co-opted for code execution without command-line parameters.
Within seconds, the attacker’s callback server logs the exfiltrated data: h: victims-macbook u: victim_user_name p: victim_platform
Once the debugger is connected, we utilize a standard Node.js library to execute our command: require("child_process").exec("<command>")
Téléchargement ou réutilisation d’un runtime Node.js légitime, renommé ( FbtRYX8x.exe )
On startup and every 10 seconds, send an HTTP GET to http://<IP>:8080/ Include query parameters: h (os.hostname), u (os.userInfo().username), p (os.platform)
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.