Divergent: "Fileless" NodeJS Malware Burrows Deep Within the Host
Summary: Cisco Talos analyzed a malware family called Divergent that uses NodeJS and the legitimate WinDivert utility, installing itself as an HTA loader in the registry and running via reflective PE injection to leave few artifacts. The malware performs five anti-analysis checks, disables Windows Defender and Windows Updates, and is primarily designed to conduct click-fraud, rewriting TCP SYN packets to mimic Android or iOS devices and contacting a hardcoded IP of 176.9.117.194.
Bottom line: Divergent disables Windows Defender and Windows Updates on infected hosts and then uses the legitimate WinDivert driver to block antivirus traffic on ports 80 and 443, so the endpoint protection you rely on can be silently neutralized while the host keeps generating fraudulent ad clicks.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026