New DinDoor Backdoor Abuses Deno Runtime and MSI Installers to Evade Detection

Cybersecuritynews •Tushar Subhra Dutta • April 22, 2026

A newly identified backdoor called DinDoor is using the legitimate Deno JavaScript runtime and MSI installer files to quietly slip past security defenses and compromise targeted systems. The malware, tracked as a variant of the Tsundere Botnet, relies on trusted, signed runtime environments instead of deploying standard compiled implants. This makes detection far more difficult […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

DinDoor Backdoor Uses Deno Runtime and MSI Installers to Evade Detection A newly identified backdoor, DinDoor, exploits the Deno JavaScript runtime and MSI installer files to execute malicious code while avoiding detection. This malware is associated with the Tsundere Botnet and leverages trusted environments to deploy fileless or low-footprint attacks in enterprise systems. By utilizing legitimate software components, DinDoor complicates traditional security measures, making it difficult for defenders to identify and mitigate the threat. The backdoor's stealthy nature allows it to infiltrate systems without raising alarms, posing a significant risk to organizations relying on these technologies. Current reports indicate that DinDoor is actively being used in targeted attacks, although specific numbers of affected systems remain undisclosed. Security professionals are urged to enhance their monitoring and detection capabilities to counter this emerging threat. 2 sources 65

Extracted Entities

New DinDoor Backdoor Abuses Deno Runtime and MSI Installers to Evade Detection

The full story

Extracted Entities

Attack Types (1)

Malware (2)

Tools (2)