⌁ CyberSecurityBoardThreat Intel · CVEs · Products
Cyber Products

Node.js v24.13.0 Used as Implant Runtime

June 25, 2026

The phishing campaign downloads a legitimate Node.js v24.13.0 runtime from nodejs.org to execute the TonRAT implant in user space.

Discovered from: Microsoft Warns of Photo ZIP Phishing Campaign Targeting Hotels with Node.js Implant