Deno Runtime Abuse for Infostealer and Loader Delivery

Sophos investigated a set of intrusions that share a common execution backbone: abuse of the legitimate Deno JavaScript runtime to run attacker controlled code on Windows endpoints. Initial access arrives through several delivery routes that all end in user execution. The most common is a ClickFix social engineering lure served from compromised websites or fake Cloudflare style verification prompts, which instruct the victim to paste a prepared command into the Windows Run dialog or a terminal window. Other routes include a hidden PowerShell cradle launched from an active browser session and SEO poisoning that surfaces a spoofed software project page, leading the victim to download and run a trojanized installer masquerading as a well known administration utility.

The pasted or downloaded command starts a multi stage staging chain built from trusted system tooling. Command lines are frequently obfuscated by assembling a download address from concatenated shell variables before piping it to PowerShell for in memory execution. The chain reaches msiexec, which installs an MSI from a remote address or through a WMI product install call, and the installer drops lightweight VBS and PowerShell loaders into the user profile. Those loaders retrieve the Deno runtime, either through the Windows package manager or by downloading a release archive directly with a command line utility, then invoke Deno against remote JavaScript hosted on attacker infrastructure. Running the payload through a signed developer runtime, often wrapped in a headless console host so no window appears, lets execution blend with routine tooling and defeats detections keyed on traditional script hosts.

Once the runtime is established the operators pursue collection, persistence, and command and control. The delivered JavaScript scripts orchestrate an infostealer, which, in one campaign, is a compiled Python component run through the windowless Python host that harvests system information, browser and extension data, cryptocurrency wallet material, and keystrokes. Persistence is set through registry Run keys and scheduled tasks that relaunch the Deno runtime at logon or on a schedule, and downloaded payload content is, at times, written into a registry value disguised as a browser update so it never lands on disk as a file. Command and control runs over web protocols to attacker domains and, in some cases, through an ephemeral cloud tunnel that fronts the staging address. In hands on intrusions the operators used a trojanized administration utility to obtain a SYSTEM shell, enumerated the domain and installed security products, and saved the Security Account Manager hive to disk for offline credential extraction. Tracking identifiers embedded in the JavaScript scripts, distinguishing separate campaign names and identifiers behind shared infrastructure, indicate a malware as a service style operation serving multiple operators.