NodeLoader Used to Deliver Malware

Technical analysis of a malicious campaign leveraging a compiled Node.js loader (“NodeLoader”) that prompts UAC (via sudo-prompt), creates a hidden ProgramData folder, and downloads PowerShell scripts which deploy drop1.exe (stealers: Phemedrone/Lumma) and drop2.exe (an XMRig miner). The report describes defense-evasion (process checks, Defender exclusions, uninstalling updates, stopping EventLog), persistence via a created Windows service, shellcode-based injection for Lumma, low AV detection due to large pkg-compiled binaries, and provides IoCs and evidence of active cryptocurrency transactions.