Loading malware…
DinDoor is a Deno-based Windows backdoor and loader that abuses the legitimate Deno JavaScript and TypeScript runtime to execute staged payloads while blending with trusted software and administrative tooling. It has been associated with multiple 2026 intrusion sets, including activity attributed to the Iranian state-linked group MuddyWater, also tracked as Seedworm, and has also appeared in financially motivated or mixed-use malware delivery campaigns that impersonated popular software and AI tools.
DinDoor is typically delivered through malicious MSI installers, PowerShell-driven installation chains, and social-engineering lures. Observed delivery mechanisms include fake installers and plugins hosted on trusted platforms, ClickFix-style prompts that trick users into running commands, Microsoft Teams social engineering, and campaigns using phishing-style or deceptive software-update themes. Infection chains commonly install or locate the Deno runtime through legitimate package managers, then launch remote JavaScript payloads with broad Deno permissions.
Operationally, DinDoor functions as a lightweight stager or continuous eval-loop that contacts command-and-control infrastructure, retrieves secondary JavaScript stages, and executes them in memory. It has been observed establishing persistence through Windows Run-key mechanisms, registering infected hosts, fingerprinting systems, and fetching follow-on payloads. In several campaigns, DinDoor served as the precursor to a more capable Deno-based remote access trojan sometimes referred to as DenoRAT or linked by researchers to Smokest-like functionality.
Follow-on capabilities documented in DinDoor-linked chains include host reconnaissance, command execution, screenshot capture, browser and cryptocurrency-wallet data theft, clipboard monitoring, SOCKS5 proxying, custom remote desktop or VNC-style control, and exfiltration of system information. Some related payloads also targeted Chromium- and Gecko-based browser data, messaging-app artifacts, password-manager extensions, and multi-factor authentication-related data. Certain observed variants or downstream payloads used in-memory execution, obfuscation, and native Windows API access through Deno FFI to reduce forensic visibility and improve post-compromise flexibility.
DinDoor has been reported in targeted intrusions against organizations in the financial, transportation, defense-adjacent, and nonprofit sectors in the United States, Israel, and Canada, as well as in broader malware distribution campaigns aimed at creators, gamers, AI enthusiasts, and users seeking unofficial software. Reporting has also described DinDoor as a variant or evolution of the Tsundere botnet ecosystem. Across campaigns, its defining characteristic is the use of the Deno runtime as a dual-use execution substrate for stealthy staged malware delivery, persistence, and remote access.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This JavaScript file acts as the primary DinDoor stager. DinDoor operates as a tiny, continuous evaluation loop. It reaches out to a command-and-control server to fetch a secondary malware stager.
Related coverage Escalation in the Shadows: Iranian APT Seedworm Deploys ‘Dindoor’ Backdoor in New Cyberoffensive
The campaign, publicly disclosed in early March 2026, leveraged two malware families Dindoor, a backdoor utilizing the Deno runtime, and Fakeset, a Python-based implant alongside legitimate tooling and cloud infrastructure to establish persistent access and enable data exfiltration.
The group deployed two malware, a newly discovered backdoor called Dindoor and a Python-based tool called Fakeset, across multiple victim environments.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
The infection begins when a user visits a malicious GitHub or SourceForge repository and copies a command into their terminal, believing they are installing legitimate software.
The observed activity maps to several established ATT&CK techniques, including spearphishing for initial access, command and scripting interpreter abuse (expanded to include Deno)
Then, the MSI file writes and executes a Windows batch file. This batch file launches an artificial intelligence-generated PowerShell script named Griffin20.ps1.
Once Deno is available, the script runs it with full permissions using deno run -A to fetch and execute the remote launcher.
The attack begins with a ClickFix-style social engineering lure. Specifically, the attackers trick a victim into executing a command via the Windows Run prompt. | Specifically, the attackers trick a victim into executing a command via the Windows Run prompt. This command downloads and runs a Microsoft Installer (MSI) file.
The attackers use Obfuscator.io to hide the secondary stager code. This obfuscation greatly complicates the analysis process for incident responders.
Through this interaction, the user was convinced to execute a malicious installer named update_ms.msi, masquerading as a Windows update package.
This RAT can steal data from browsers and crypto wallets... It targets over 50 crypto wallet browser extensions and software wallets including Atomic Wallet, Exodus, and Electrum...
This RAT can steal data from browsers and crypto wallets, capture screenshots...
The observed activity maps to several established ATT&CK techniques, including spearphishing for initial access, command and scripting interpreter abuse (expanded to include Deno), ingress tool transfer via cloud-hosted payloads, exfiltration over web services using Rclone, and application-layer command-and-control mechanisms.
96 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
46 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Deno-delivered stager/backdoor component that continuously polls C2 to fetch a secondary stager, helping establish the next stage of the intrusion.
Related coverage Escalation in the Shadows: Iranian APT Seedworm Deploys ‘Dindoor’ Backdoor in New Cyberoffensive
A Deno-based loader that fetches and executes the next-stage stager from C2 via eval(). It is used early in the ClickFix infection chain and supports persistence indirectly by being re-fetched and written to disk by the next stage.
A purported Seedworm backdoor that reportedly uses the Deno runtime for execution and may be signed with the certificate 'Amy Cherne'.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.