Node.js Puppeteer-style browser automation for cookie theft

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•1

Detects the execution of node.exe or electron.exe with command-line arguments indicative of browser automation (e.g., launching headless browsers, cookie access) when executed from high-risk, writable directories like AppData\Temp, AppData\Roaming, ProgramData, or Users\Public. This behavior is frequently associated with information-stealing malware or unauthorized browser automation.