T1070.004

File Deletion

discovered 2026-06-17

setup.cjs self-deletes via fs.rmSync(__filename) after spawning the detached stage-2 process.

View on MITRE ATT&CK

Seen in packages

Campaigns