Skip to content

T1059.007 JavaScript

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.6

JScript is the Microsoft implementation of the same scripting standard. JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the Component Object Model and Internet Explorer HTML Application (HTA) pages.534

JavaScript for Automation (JXA) is a macOS scripting language based on JavaScript, included as part of Apple’s Open Scripting Architecture (OSA), that was introduced in OSX 10.10. Apple’s OSA provides scripting capabilities to control applications, interface with the operating system, and bridge access into the rest of Apple’s internal APIs. As of OSX 10.10, OSA only supports two languages, JXA and AppleScript. Scripts can be executed via the command line utility osascript, they can be compiled into applications or script files via osacompile, and they can be compiled and executed in memory of other programs by leveraging the OSAKit Framework.18792

Adversaries may abuse various implementations of JavaScript to execute various behaviors. Common uses include hosting malicious scripts on websites as part of a Drive-by Compromise or downloading and executing these script files as secondary payloads. Since these payloads are text-based, it is also very common for adversaries to obfuscate their content as part of Obfuscated Files or Information.

Item Value
ID T1059.007
Sub-techniques T1059.001, T1059.002, T1059.003, T1059.004, T1059.005, T1059.006, T1059.007, T1059.008, T1059.009, T1059.010, T1059.011, T1059.012, T1059.013
Tactics TA0002
Platforms Linux, Windows, macOS
Version 2.2
Created 23 June 2020
Last Modified 24 October 2025

Procedure Examples

ID Name Description
S0622 AppleSeed AppleSeed has the ability to use JavaScript to execute PowerShell.13
G0050 APT32 APT32 has used JavaScript for drive-by downloads and C2 communications.6162
S0373 Astaroth Astaroth uses JavaScript to perform its core functionalities. 4445
S0640 Avaddon Avaddon has been executed through a malicious JScript downloader.2627
S1246 BeaverTail BeaverTail has executed malicious JavaScript code.1617181920 BeaverTail has also been compiled with the Qt framework to execute in both Windows and macOS.21
S1180 BlackByte Ransomware BlackByte Ransomware is distributed as a JavaScript launcher file.25
S0482 Bundlore Bundlore can execute JavaScript by injecting it into the victim’s browser.55
C0015 C0015 During C0015, the threat actors used a malicious HTA file that contained a mix of encoded HTML and JavaScript/VBScript code.102
C0017 C0017 During C0017, APT41 deployed JScript web shells on compromised systems.98
S0631 Chaes Chaes has used JavaScript and Node.Js information stealer script that exfiltrates data using the node process.54
G0080 Cobalt Group Cobalt Group has executed JavaScript scriptlets on the victim’s machine.808182838485
S0154 Cobalt Strike The Cobalt Strike System Profiler can use JavaScript to perform reconnaissance actions.14
G1052 Contagious Interview Contagious Interview has leveraged JavaScript in the execution of their downloader malware targeting Windows devices using a NodeJS script titled nvidia.js.74
S0673 DarkWatchman DarkWatchman uses JavaScript to perform its core functionalities.59
S0695 Donut Donut can generate shellcode outputs that execute via JavaScript or JScript.12
G1006 Earth Lusca Earth Lusca has manipulated legitimate websites to inject malicious JavaScript code as part of their watering hole operations.70
S0634 EnvyScout EnvyScout can write files to disk with JavaScript using a modified version of the open-source tool FileSaver.38
G0120 Evilnum Evilnum has used malicious JavaScript files on the victim’s machine.96
G0037 FIN6 FIN6 has used malicious JavaScript to steal payment card data from e-commerce sites.64
G0046 FIN7 FIN7 used JavaScript scripts to help perform tasks on the victim’s machine.7879
S1144 FRP FRP can support the use of a JSON configuration file.11
S1138 Gootloader Gootloader can execute a Javascript file for initial infection.5150
S0417 GRIFFON GRIFFON is written in and executed as JavaScript.31
S1249 HexEval Loader HexEval Loader has executed malicious JavaScript code.3233
G0126 Higaisa Higaisa used JavaScript to execute additional files.868788
G0119 Indrik Spider Indrik Spider has used malicious JavaScript files for several components of their attack.92
S0260 InvisiMole InvisiMole can use a JavaScript file as part of its execution chain.43
S0283 jRAT jRAT has been distributed as HTA files with JScript.49
S0648 JSS Loader JSS Loader can download and execute JavaScript files.46
G0094 Kimsuky Kimsuky has used JScript for logging and downloading additional tools.9089 Kimsuky has used TRANSLATEXT, which contained four Javascript files for bypassing defenses, collecting sensitive information and screenshots, and exfiltrating data.91
S0356 KONNI KONNI has executed malicious JavaScript code.56
S1075 KOPILUWAK KOPILUWAK had used Javascript to perform its core functions.58
S1160 Latrodectus Latrodectus has used JavaScript files as part its infection chain during malicious spam
email campaigns.414042
G0140 LazyScripter LazyScripter has used JavaScript in its attacks.75
G0077 Leafminer Leafminer infected victims using JavaScript code.94
S0455 Metamorfo Metamorfo includes payloads written in JavaScript.15
G0021 Molerats Molerats used various implants, including those built with JS, on target machines.93
G1019 MoustachedBouncer MoustachedBouncer has used JavaScript to deliver malware hosted on HTML pages.67
G0069 MuddyWater MuddyWater has used JavaScript files to execute its POWERSTATS payload.536968
G0129 Mustang Panda Mustang Panda has executed a JavaScript payload utilizing wscript.exe on the endpoint.95
S0228 NanHaiShu NanHaiShu executes additional Jscript code on the victim’s machine.22
C0016 Operation Dust Storm During Operation Dust Storm, the threat actors used JavaScript code.101
C0036 Pikabot Distribution February 2024 Pikabot Distribution February 2024 utilized obfuscated JavaScript files for initial Pikabot payload download.100
S0223 POWERSTATS POWERSTATS can use JavaScript code for execution.53
S0650 QakBot The QakBot web inject module can inject Java Script into web banking pages visited by the victim.2423
G1031 Saint Bear Saint Bear has delivered malicious Microsoft Office files containing an embedded JavaScript object that would, on execution, download and execute OutSteel and Saint Bot.63
G0121 Sidewinder Sidewinder has used JavaScript to drop and execute malware loaders.6566
G0091 Silence Silence has used JS scripts.73
S1124 SocGholish The SocGholish payload is executed as JavaScript.34353637
S0646 SpicyOmelette SpicyOmelette has the ability to execute arbitrary JavaScript code on a compromised host.52
G1033 Star Blizzard Star Blizzard has used JavaScript to redirect victim traffic from an adversary controlled server to a server hosting the Evilginx phishing framework.97
S1183 StrelaStealer StrelaStealer has been distributed as a malicious JavaScript object.282930
G0092 TA505 TA505 has used JavaScript for code execution.7677
G1037 TA577 TA577 has used JavaScript to execute additional malicious payloads.71
G1038 TA578 TA578 has used JavaScript files in malware execution chains.71
G0010 Turla Turla has used various JavaScript-based backdoors.60
S0476 Valak Valak can execute JavaScript containing configuration data for establishing persistence.39
S1116 WARPWIRE WARPWIRE is a credential harvester written in JavaScript.47
C0037 Water Curupira Pikabot Distribution Water Curupira Pikabot Distribution initial delivery included obfuscated JavaScript objects stored in password-protected ZIP archives.99
G1035 Winter Vivern Winter Vivern delivered malicious JavaScript to exploit targets when exploiting Roundcube Webmail servers.72
S0341 Xbash Xbash can execute malicious JavaScript payloads on the victim’s machine.48
S1248 XORIndex Loader XORIndex Loader has executed malicious JavaScript code.57

Mitigations

ID Mitigation Description
M1040 Behavior Prevention on Endpoint On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent JavaScript scripts from executing potentially malicious downloaded content 10.
M1042 Disable or Remove Feature or Program Turn off or restrict access to unneeded scripting components.
M1038 Execution Prevention Denylist scripting where appropriate.
M1021 Restrict Web-Based Content Script blocking extensions can help prevent the execution of JavaScript and HTA files that may commonly be used during the exploitation process. For malicious code served up through ads, adblockers can help prevent that code from executing in the first place.

References

  1. Apple. (2016, June 13). About Mac Scripting. Retrieved April 14, 2021. ↩

  2. Dominic Chell. (2021, January 1). macOS Post-Exploitation Shenanigans with VSCode Extensions. Retrieved April 20, 2021. ↩

  3. Microsoft. (2007, August 15). The World of JScript, JavaScript, ECMAScript …. Retrieved June 23, 2020. ↩

  4. Microsoft. (2017, January 18). Windows Script Interfaces. Retrieved June 23, 2020. ↩

  5. Microsoft. (2018, May 31). Translating to JScript. Retrieved June 23, 2020. ↩

  6. OpenJS Foundation. (n.d.). Node.js. Retrieved June 23, 2020. ↩

  7. Phil Stokes. (2019, December 5). macOS Red Team: Calling Apple APIs Without Building Binaries. Retrieved July 17, 2020. ↩

  8. Pitt, L. (2020, August 6). Persistent JXA. Retrieved April 14, 2021. ↩

  9. Tony Lambert. (2021, February 18). Clipping Silver Sparrow’s wings: Outing macOS malware before it takes flight. Retrieved April 20, 2021. ↩

  10. Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021. ↩

  11. fatedier. (n.d.). What is frp?. Retrieved July 10, 2024. ↩

  12. TheWover. (2019, May 9). donut. Retrieved March 25, 2022. ↩

  13. Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021. ↩

  14. Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved September 12, 2024. ↩

  15. Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020. ↩

  16. eSentire Threat Response Unit (TRU). (2024, November 14). Bored BeaverTail & InvisibleFerret Yacht Club – A Lazarus Lure Pt.2. Retrieved October 17, 2025. ↩

  17. Insikt Group. (2025, February 13). Inside the Scam: North Korea’s IT Worker Threat. Retrieved October 17, 2025. ↩

  18. Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025. ↩

  19. Seongsu Park. (2024, November 4). From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West. Retrieved October 17, 2025. ↩

  20. Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025. ↩

  21. Unit42. (2024, October 9). Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware. Retrieved October 17, 2025. ↩

  22. F-Secure Labs. (2016, July). NANHAISHU RATing the South China Sea. Retrieved July 6, 2018. ↩

  23. Kenefick, I. et al. (2022, October 12). Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike. Retrieved February 6, 2023. ↩

  24. Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021. ↩

  25. Rodel Mendrez & Lloyd Macrohon. (2021, October 15). BlackByte Ransomware – Pt. 1 In-depth Analysis. Retrieved December 16, 2024. ↩

  26. Security Lab. (2020, June 5). Avaddon: From seeking affiliates to in-the-wild in 2 days. Retrieved August 19, 2021. ↩

  27. Gahlot, A. (n.d.). Threat Hunting for Avaddon Ransomware. Retrieved August 19, 2021. ↩

  28. Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhaparwal, Anmol Maurya & Vishwa Thothathri, Palo Alto Networks. (2024, March 22). Large-Scale StrelaStealer Campaign in Early 2024. Retrieved December 31, 2024. ↩

  29. Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024. ↩

  30. Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024. ↩

  31. Namestnikov, Y. and Aime, F. (2019, May 8). FIN7.5: the infamous cybercrime rig “FIN7” continues its activities. Retrieved October 11, 2019. ↩

  32. Kirill Boychenko. (2025, April 4). Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads. Retrieved October 20, 2025. ↩

  33. Kirill Boychenko. (2025, June 25). Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages. Retrieved October 19, 2025. ↩

  34. Andrew Northern. (2022, November 22). SocGholish, a very real threat from a very fake update. Retrieved February 13, 2024. ↩

  35. Milenkoski, A. (2022, November 7). SocGholish Diversifies and Expands Its Malware Staging Infrastructure to Counter Defenders. Retrieved March 22, 2024. ↩

  36. Red Canary. (2024, March). Red Canary 2024 Threat Detection Report: SocGholish. Retrieved March 22, 2024. ↩

  37. Secureworks. (n.d.). GOLD PRELUDE . Retrieved March 22, 2024. ↩

  38. MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021. ↩

  39. Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020. ↩

  40. Batista, J. (2024, June 17). Latrodectus, are you coming back?. Retrieved September 13, 2024. ↩

  41. Stepanic, D. and Bousseaden, S. (2024, May 15). Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID. Retrieved September 13, 2024. ↩

  42. Unit 42. (2024, June 25). 2024-06-25-IOCs-from-Latrodectus-activity. Retrieved September 13, 2024. ↩

  43. Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020. ↩

  44. Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024. ↩

  45. GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020. ↩

  46. Loui, E. and Reynolds, J. (2021, August 30). CARBON SPIDER Embraces Big Game Hunting, Part 1. Retrieved September 20, 2021. ↩

  47. McLellan, T. et al. (2024, January 12). Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation. Retrieved February 27, 2024. ↩

  48. Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018. ↩

  49. Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019. ↩

  50. Pirozzi, A. (2021, June 16). Gootloader: ‘Initial Access as a Service’ Platform Expands Its Search for High Value Targets. Retrieved May 28, 2024. ↩

  51. Szappanos, G. & Brandt, A. (2021, March 1). “Gootloader” expands its payload delivery options. Retrieved September 30, 2022. ↩

  52. CTU. (2018, September 27). Cybercriminals Increasingly Trying to Ensnare the Big Financial Fish. Retrieved September 20, 2021. ↩

  53. ClearSky Cyber Security. (2018, November). MuddyWater Operations in Lebanon and Oman: Using an Israeli compromised domain for a two-stage campaign. Retrieved November 29, 2018. ↩↩

  54. Salem, E. (2020, November 17). CHAES: Novel Malware Targeting Latin American E-Commerce. Retrieved June 30, 2021. ↩

  55. Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020. ↩

  56. Threat Intelligence Team. (2021, August 23). New variant of Konni malware used in campaign targetting Russia. Retrieved January 5, 2022. ↩

  57. Kirill Boychenko. (2025, July 14). Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader. Retrieved October 19, 2025. ↩

  58. Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023. ↩

  59. Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022. ↩

  60. ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018. ↩

  61. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018. ↩

  62. Adair, S. and Lancaster, T. (2020, November 6). OceanLotus: Extending Cyber Espionage Operations Through Fake Websites. Retrieved November 20, 2020. ↩

  63. Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022. ↩

  64. Chen, J. (2019, October 10). Magecart Card Skimmers Injected Into Online Shops. Retrieved September 9, 2020. ↩

  65. Hegel, T. (2021, January 13). A Global Perspective of the SideWinder APT. Retrieved January 27, 2021. ↩

  66. Rewterz. (2020, June 22). Analysis on Sidewinder APT Group – COVID-19. Retrieved January 29, 2021. ↩

  67. Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023. ↩

  68. FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022. ↩

  69. Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018. ↩

  70. Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022. ↩

  71. Proofpoint Threat Research and Team Cymru S2 Threat Research. (2024, April 4). Latrodectus: This Spider Bytes Like Ice . Retrieved May 31, 2024. ↩↩

  72. Matthieu Faou. (2023, October 25). Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers. Retrieved July 29, 2024. ↩

  73. Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024. ↩

  74. Amaury G., Coline Chavane, Felix Aimé and Sekoia TDR. (2025, March 31). From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tactic. Retrieved April 1, 2025. ↩

  75. Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024. ↩

  76. Proofpoint Staff. (2017, September 27). Threat Actor Profile: TA505, From Dridex to GlobeImposter. Retrieved May 28, 2019. ↩

  77. Proofpoint Staff. (2018, June 8). TA505 shifts with the times. Retrieved May 28, 2019. ↩

  78. Carr, N., et al. (2018, August 01). On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation. Retrieved August 23, 2018. ↩

  79. Platt, J. and Reeves, J.. (2019, March). FIN7 Revisited: Inside Astra Panel and SQLRat Malware. Retrieved June 18, 2019. ↩

  80. Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018. ↩

  81. Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018. ↩

  82. Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018. ↩

  83. Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018. ↩

  84. Unit 42. (2018, October 25). New Techniques to Uncover and Attribute Financial actors Commodity Builders and Infrastructure Revealed. Retrieved December 11, 2018. ↩

  85. Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019. ↩

  86. Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021. ↩

  87. Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021. ↩

  88. PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021. ↩

  89. CISA, FBI, CNMF. (2020, October 27). https://us-cert.cisa.gov/ncas/alerts/aa20-301a. Retrieved November 4, 2020. ↩

  90. Kim, J. et al. (2019, October). KIMSUKY GROUP: TRACKING THE KING OF THE SPEAR PHISHING. Retrieved November 2, 2020. ↩

  91. Park, S. (2024, June 27). Kimsuky deploys TRANSLATEXT to target South Korean academia. Retrieved October 14, 2024. ↩

  92. Symantec Threat Intelligence. (2020, June 25). WastedLocker: Symantec Identifies Wave of Attacks Against U.S. Organizations. Retrieved May 20, 2021. ↩

  93. GReAT. (2019, April 10). Gaza Cybergang Group1, operation SneakyPastes. Retrieved May 13, 2020. ↩

  94. Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018. ↩

  95. Asheer Malhotra, Jungsoo An, Kendall Mc. (2022, May 5). Mustang Panda deploys a new wave of malware targeting Europe. Retrieved August 4, 2025. ↩

  96. Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021. ↩

  97. Microsoft Threat Intelligence. (2023, December 7). Star Blizzard increases sophistication and evasion in ongoing attacks. Retrieved February 13, 2024. ↩

  98. Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022. ↩

  99. Shinji Robert Arasawa, Joshua Aquino, Charles Steven Derion, Juhn Emmanuel Atanque, Francisrey Joshua Castillo, John Carlo Marquez, Henry Salcedo, John Rainier Navato, Arianne Dela Cruz, Raymart Yambot & Ian Kenefick. (2024, January 9). Black Basta-Affiliated Water Curupira’s Pikabot Spam Campaign. Retrieved July 17, 2024. ↩

  100. Daniel Stepanic & Salim Bitam. (2024, February 23). PIKABOT, I choose you!. Retrieved July 12, 2024. ↩

  101. Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021. ↩

  102. DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022. ↩