Microsoft and Cisco Talos both published comprehensive reports about the malware, explaining how the attack gets users to download a malicious HTML file then uses the popular Node.js framework and WinDivert apps to infect and take control of a computer. The infected HTML application, or HTA, is typically distributed through malicious ads sent through legitimate content delivery services, like Amazon Cloudfront. Once the file runs, it downloads additional Javascript code that eventually starts PowerShell and writes a malicious script. That happens multiple times, with each instance of PowerShell leading to the next attack, starting with disabling Windows Defender Antivirus and ending with a JavaScript payload that runs on node.exe. The final JavaScript payload turns the infected device into a proxy zombie that can be used by an attacker to execute various malicious activities. Microsoft calls the malware Nodersok while Cisco Talos calls it Divergent.