Loading malware…
DinDoor is a Deno-based JavaScript backdoor and loader used in multiple 2026 intrusion campaigns. It is most strongly associated with the Iranian state-linked espionage actor MuddyWater, also tracked as Seedworm, although some reporting also notes overlap with TAG-150 infrastructure and malware ecosystems. The malware abuses the legitimate Deno runtime to execute JavaScript or TypeScript payloads, helping it blend with trusted tooling and reduce traditional binary-based detection opportunities.
Observed infection chains commonly use MSI installers, PowerShell, and command-line execution to install or locate Deno and then launch DinDoor as an initial stager. In targeted intrusions, DinDoor has also been delivered through Microsoft Teams social engineering, fake software installers, malicious repositories on trusted developer platforms, and ClickFix-style lures that trick users into running commands. Campaign lures have impersonated software and AI tools such as ChatGPT and Claude, as well as audio and creative applications, indicating both espionage-focused and broader opportunistic distribution.
Operationally, DinDoor functions as a lightweight continuous fetch-and-execute loop. It fingerprints the host, contacts command-and-control infrastructure, retrieves secondary stages, and executes returned code in memory, often via eval-style logic. It has been observed establishing persistence through Windows Run-key mechanisms and registering infected hosts before downloading follow-on payloads. Some variants use localhost listener behavior as a mutex or anti-reinfection mechanism. DinDoor has been described as a backdoor in its own right and also as a stager that delivers more capable Deno-based remote access tooling.
Follow-on payloads associated with DinDoor provide extensive post-compromise capability, including remote command execution, host reconnaissance, screenshot capture, browser and cryptocurrency-wallet data theft, clipboard monitoring, SOCKS5 proxying, and remote desktop or VNC-style control. In some intrusions, DinDoor led to deployment of additional malware such as DenoRAT, NightshadeC2, and the Python-based implant Fakeset. Reporting also links DinDoor-related operations to credential harvesting, cloud administration enumeration, Active Directory reconnaissance, persistence establishment, and data exfiltration using legitimate cloud services and tools such as Rclone.
Targeting linked to DinDoor includes organizations in the financial, transportation, defense-adjacent, nonprofit, and software sectors in the United States, Israel, Canada, and elsewhere. Separate distribution campaigns have also targeted creators, gamers, AI enthusiasts, and users seeking unofficial software. DinDoor exemplifies a broader trend of threat actors abusing legitimate runtimes, package managers, cloud services, and trusted platforms to reduce signature-based visibility while maintaining flexible in-memory execution and staged delivery.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Symantec named the Deno based JavaScript malware “DinDoor” and attributed it to MuddyWater.
Symantec named the Deno based JavaScript malware “DinDoor” and attributed it to MuddyWater.
The campaign, publicly disclosed in early March 2026, leveraged two malware families Dindoor, a backdoor utilizing the Deno runtime, and Fakeset, a Python-based implant alongside legitimate tooling and cloud infrastructure to establish persistent access and enable data exfiltration.
The group deployed two malware, a newly discovered backdoor called Dindoor and a Python-based tool called Fakeset, across multiple victim environments.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
The infection begins when a user visits a malicious GitHub or SourceForge repository and copies a command into their terminal, believing they are installing legitimate software.
The observed activity maps to several established ATT&CK techniques, including spearphishing for initial access, command and scripting interpreter abuse (expanded to include Deno)
Then, the MSI file writes and executes a Windows batch file. This batch file launches an artificial intelligence-generated PowerShell script named Griffin20.ps1.
ChainShell is a thin execution shell, the server sends JavaScript via `new Function()` and the agent executes and returns results via `serverSend()`.
The attack begins with a ClickFix-style social engineering lure. Specifically, the attackers trick a victim into executing a command via the Windows Run prompt. | Specifically, the attackers trick a victim into executing a command via the Windows Run prompt. This command downloads and runs a Microsoft Installer (MSI) file.
The attackers use Obfuscator.io to hide the secondary stager code. This obfuscation greatly complicates the analysis process for incident responders.
Through this interaction, the user was convinced to execute a malicious installer named update_ms.msi, masquerading as a Windows update package.
This RAT can steal data from browsers and crypto wallets... It targets over 50 crypto wallet browser extensions and software wallets including Atomic Wallet, Exodus, and Electrum...
This RAT can steal data from browsers and crypto wallets, capture screenshots...
The observed activity maps to several established ATT&CK techniques, including spearphishing for initial access, command and scripting interpreter abuse (expanded to include Deno), ingress tool transfer via cloud-hosted payloads, exfiltration over web services using Rclone, and application-layer command-and-control mechanisms.
98 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
47 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Deno-delivered stager/backdoor component that continuously polls C2 to fetch a secondary stager, helping establish the next stage of the intrusion.
Related coverage Escalation in the Shadows: Iranian APT Seedworm Deploys ‘Dindoor’ Backdoor in New Cyberoffensive
A Deno-based loader that fetches and executes the next-stage stager from C2 via eval(). It is used early in the ClickFix infection chain and supports persistence indirectly by being re-fetched and written to disk by the next stage.
A purported Seedworm backdoor that reportedly uses the Deno runtime for execution and may be signed with the certificate 'Amy Cherne'.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.