🎯 JavaScript

The items that name it 2

• From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
  writeup2026-10-30It is written here as Command and Scripting Interpreter: JavaScript/JScript (T1059.007).

  Bun executed attacker-supplied JavaScript modules.

• Socket: Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
  writeup2026-09-20

  Implant, resolvers, loaders, and RAT are implemented in obfuscated JavaScript evaluated via eval() and Function().