Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool

 

Threat actors are abusing the legitimate, signed Node.js runtime (node.exe) to execute malicious JavaScript, establish persistence, and deploy malware while blending in with normal system activity. Symantec researchers observed this technique in attacks against government entities, technology companies, hotels, and financial organizations beginning as early as February 2026.

How the Attack Works

1. Attackers gain initial access, often through ClickFix social engineering campaigns that trick users into running commands.
2. They download the official Node.js installer from the legitimate Node.js website.
3. The trusted node.exe process is then used to execute attacker-controlled JavaScript payloads.
4. Persistence is established through mechanisms such as Windows Registry Run keys, allowing the malicious scripts to relaunch after reboot or login.

Why Attackers Like This Technique

• Node.js is legitimate and digitally signed, making it less suspicious than traditional malware binaries.
• Malicious code exists in scripts instead of compiled executables, reducing the effectiveness of signature-based detections.
• The technique supports "living off the land" tactics by leveraging trusted software already common in enterprise environments.

Malware and Tools Observed

Researchers linked Node.js-based attacks to several payloads and frameworks, including:

• AdaptixC2
• Cobalt Strike
• ModeloRAT / Mistic (MLTBackdoor)
• GateKeeper
• C2Looper (Rust-based backdoor)
• AsukaStealer
• EtherRAT

Additional Concern: EtherHiding

Some campaigns used EtherHiding, where blockchain infrastructure is leveraged to store or retrieve command-and-control (C2) information. This can make traditional blocking strategies less effective because attackers can rapidly change C2 locations through blockchain updates.

What Security Teams Should Watch For

For enterprise administrators and SOC teams:

• Unexpected Node.js installations on non-developer workstations.
• node.exe launching PowerShell, CMD, or other administrative tools.
• Registry Run Key entries referencing Node.js scripts.
• Node.js processes making unusual outbound network connections.
• ClickFix-style lures, fake CAPTCHA pages, or prompts instructing users to copy and execute commands.

Bottom Line

This is not a vulnerability in Node.js itself. Instead, attackers are exploiting the trust organizations place in a common development runtime to evade detection and execute malicious code. Organizations should treat unexpected Node.js activity as a potential security signal, especially on endpoints where development tools are not normally used.