Node.js Abuse: Attackers Deploy Malware via Trusted Runtime

Threat actors are increasingly exploiting the legitimate Node.js JavaScript runtime to deliver malicious payloads, circumventing traditional signature-based detection mechanisms. This tactic has been observed in targeted attacks against government departments, technology companies, and hotels since February 2026, as detailed in a recent report by the Symantec Threat Hunter Team.

Overview of Node.js Runtime Malware Delivery

The appeal of using node.exe, the binary that runs Node.js, lies in its status as a legitimate, signed developer tool. By embedding malicious code within interpreted scripts rather than a standalone binary, attackers can significantly reduce their footprint and likelihood of triggering static signature detections. Persistence is often established through registry Run key entries, ensuring payloads relaunch at every login. This sophisticated approach highlights a shift towards abusing trusted software for covert operations, making it harder for defenders to distinguish malicious activity from benign system processes.

Technical Details and Attack Chains

One observed intrusion, spanning from March 23 to July 25, 2026, targeted an Asian technology company. Attackers downloaded the official Node.js installer directly from nodejs[.]org, then leveraged the trusted runtime to deploy a malicious implant. This implant established long-term access and facilitated command retrieval, notably employing a technique called EtherHiding for command-and-control (C2) communication. This shift to Node.js abuse occurred after initial attempts to deploy AdaptixC2 and Cobalt Strike beacons were blocked, indicating an adaptive adversary.

Several campaigns leveraging the Node.js runtime malware delivery method are attributed to an initial access broker known as KongTuke, also identified as Woodgnat. These campaigns often begin with the ClickFix social engineering technique, which tricks users into executing malicious commands under the guise of fixing an error or proving they are not bots. A variant dubbed CrashFix, associated with Woodgnat, uses a malicious Chrome extension named NexShield. In one instance, after gaining a foothold via ClickFix, attackers deployed a .NET payload called GateKeeper, which features layered encryption and victim-fingerprinting logic.

Another notable campaign targeted a U.S. fintech organization, leading to the deployment of C2Looper, a Rust-based backdoor documented by Zscaler ThreatLabz. While Node.js activity wasn’t observed in this specific incident, shared domains and attack chain similarities suggest the same threat actors were involved. The broader landscape shows multiple threat actors exploiting Node.js, utilizing tools such as an information stealer named AsukaStealer, EtherRAT, and various legitimate Microsoft and command-line utilities. This blend of living-off-the-land (LotL) tactics, dual-use tools, commodity malware, and custom backdoors like Mistic (aka MLTBackdoor) and C2Looper indicates a wide range of skill levels among the threat actors adopting this approach.

Further analysis by GuidePoint Security revealed that at least 31 organizations across e-commerce, professional services, and retail logistics have been compromised via a ClickFix social engineering technique campaign. This campaign serves fake CAPTCHA prompts, deploying persistent backdoors that abuse EtherHiding C2 via blockchain for resilient command-and-control. The use of the Polygon cryptocurrency blockchain allows attackers to dynamically update C2 details at scale, making traditional domain or IP blocking insufficient for permanent remediation.

Actionable Recommendations and Mitigations

Organisations must proactively defend against the abuse of trusted binaries like Node.js and the underlying social engineering tactics. Prioritising the following actions can significantly enhance security posture:

• Continuous Website Auditing: Regularly audit public-facing websites for suspicious changes, injected scripts, or malicious content that could facilitate ClickFix lures or similar social engineering attacks.
• Restrict Browser Extensions: Implement policies to restrict the installation of unapproved browser extensions, as these are frequently used to deliver initial payloads or maintain persistence.
• Enhanced Endpoint Detection and Response (EDR): Deploy and configure advanced EDR solutions capable of detecting anomalies in process execution, especially when legitimate tools like node.exe perform unusual network connections or file modifications. Focus on behavioral analysis rather than solely signature-based detection.
• Security Awareness Training: Conduct frequent and comprehensive security awareness training for all employees. Emphasize recognition of ClickFix-style social engineering, malicious CAPTCHA prompts, and the dangers of copying and pasting commands into system dialogs or terminals without verification.
• Network Segmentation and Least Privilege: Implement strict network segmentation and apply the principle of least privilege to limit the impact of a successful compromise. This can prevent attackers from easily deploying further tooling or moving laterally across the network even if an initial foothold is gained.
• Monitoring C2 Communications: While challenging due to blockchain usage, monitor network traffic for suspicious connections to cryptocurrency networks or unusual DNS requests that might indicate C2 activity via techniques like EtherHiding.

Related: ClickFix Campaign Exploits Polygon Blockchain for C2 Evasion, BlueNoroff Zoom Phishing Kit Targets Crypto Wallets