Node.js Execution from ProgramData

Kaung Khant Ko@kaungkhantko

•updated Jun 17, 2026•1•0•45

Identifies the execution of a Node.js binary from the C:\ProgramData directory to execute a JavaScript file. This behavior is consistent with the Lorem Ipsum portable Node.js dropper used in Rapid Brigantine's ClickFix campaign to evade static executable signatures.