Procedure examples

GRIFFON is written in and executed as JavaScript.

KOPILUWAK had used Javascript to perform its core functions.

Tsundere Botnet has the ability to run JavaScript code from the C2 server. Additionally, Tsundere Botnet has used Node.js to execute JavaScript code for the loader component.

AppleSeed has the ability to use JavaScript to execute PowerShell.

EnvyScout can write files to disk with JavaScript using a modified version of the open-source tool FileSaver.

Gootloader can execute a Javascript file for initial infection.

HexEval Loader has executed malicious JavaScript code.

InvisiMole can use a JavaScript file as part of its execution chain.

Avaddon has been executed through a malicious JScript downloader.

The SocGholish payload is executed as JavaScript.

SpicyOmelette has the ability to execute arbitrary JavaScript code on a compromised host.

BeaverTail has executed malicious JavaScript code. BeaverTail has also been compiled with the Qt framework to execute in both Windows and macOS.

DarkWatchman uses JavaScript to perform its core functionalities.

Xbash can execute malicious JavaScript payloads on the victim’s machine.

NanHaiShu executes additional Jscript code on the victim's machine.

Latrodectus has used JavaScript files as part its infection chain during malicious spam
email campaigns.

Chaes has used JavaScript and Node.Js information stealer script that exfiltrates data using the node process.

Bundlore can execute JavaScript by injecting it into the victim's browser.

GlassWorm has leveraged JavaScript to execute its malicious code to include its hidden Unicode characters using the `eval` call. GlassWorm has also utilized encrypted payloads compiled in JavaScript.

Metamorfo includes payloads written in JavaScript.

KONNI has executed malicious JavaScript code.

BlackByte Ransomware is distributed as a JavaScript launcher file.

StrelaStealer has been distributed as a malicious JavaScript object.

WARPWIRE is a credential harvester written in JavaScript.

The Cobalt Strike System Profiler can use JavaScript to perform reconnaissance actions.

Valak can execute JavaScript containing configuration data for establishing persistence.

AshTag can use JSON files to deliver payloads and configuration files.

Shai-Hulud has used JavaScript to create JSON file output and run scripts using node.js.

POWERSTATS can use JavaScript code for execution.

Astaroth uses JavaScript to perform its core functionalities.

The QakBot web inject module can inject Java Script into web banking pages visited by the victim.

jRAT has been distributed as HTA files with JScript.

JSS Loader can download and execute JavaScript files.

XORIndex Loader has executed malicious JavaScript code.

evilginx2 can inject JavaScript code into HTML content to customize phishing attacks.

FRP can support the use of a JSON configuration file.

Remcos has the ability to execute JavaScript remotely.

Donut can generate shellcode outputs that execute via JavaScript or JScript.

TeamPCP Cloud Stealer has infected victims through malicious pre and post-install scripts within the package.json file.

Mini Shai-Hulud has leveraged JavaScript runtime to execute malicious scripts.

CanisterWorm can leverage stolen tokens to execute Javascsript (deploy.js) for self-propagation.

Kali365 has executed JavaScript within victims' browsers through a React frontend that detects browser sessions to evade automated analysis, auto-copies actor-generated device codes to the victim's clipboard, and polls the actor's C2 infrastructure every three seconds to confirm when OAuth token capture has completed..