T1059.007

Command and Scripting Interpreter: JavaScript

discovered 2024-11-04

Stealer runs as JavaScript at runtime only when the SDK key-derivation functions (PrivateKey.fromMnemonic / fromHex) are invoked; no install hook, deliberately avoiding install-time scanners.

View on MITRE ATT&CK

Seen in packages

Campaigns