← All detection heuristics · HTML / Script
critical
JS_SOURCE_RELATIVE_COMMAND_LOADER
What it means
Browser JavaScript derives its origin at runtime and retrieves a clipboard command/iframe payload.
Why it fires
The script combines currentScript-derived network origin, assembled API routes, response decoding, iframe srcdoc injection, and clipboard command writing. This complete chain hides the C2 hostname from literal URL extraction.