Deno Base64 Data URI Execution

Duo Tech@duotech

•updated Jun 1, 2026•0•0•6

Detects the Deno runtime executing an in-memory script passed as a Base64-encoded Data URI, effectively bypassing disk monitoring. This technique is utilized by threat actors (e.g., DinDoor) to execute fileless malware payloads.