DinDoor Backdoor Exploits Deno and MSI Installers to Slip Past Detection

Gbhackers •Mayura Kathir • April 22, 2026

DinDoor is a newly documented backdoor that abuses the Deno JavaScript runtime and MSI installer files to execute attacker‑controlled code while sidestepping traditional detection controls quietly. Hiding behind trusted runtimes and common Windows tooling gives threat actors a flexible way to deploy fileless or low‑footprint malware into enterprise environments. Instead of shipping a conventional compiled […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

DinDoor Backdoor Uses Deno Runtime and MSI Installers to Evade Detection A newly identified backdoor, DinDoor, exploits the Deno JavaScript runtime and MSI installer files to execute malicious code while avoiding detection. This malware is associated with the Tsundere Botnet and leverages trusted environments to deploy fileless or low-footprint attacks in enterprise systems. By utilizing legitimate software components, DinDoor complicates traditional security measures, making it difficult for defenders to identify and mitigate the threat. The backdoor's stealthy nature allows it to infiltrate systems without raising alarms, posing a significant risk to organizations relying on these technologies. Current reports indicate that DinDoor is actively being used in targeted attacks, although specific numbers of affected systems remain undisclosed. Security professionals are urged to enhance their monitoring and detection capabilities to counter this emerging threat. 2 sources 65

Extracted Entities

DinDoor Backdoor Exploits Deno and MSI Installers to Slip Past Detection

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)