Node.js Runtime Turned into Malware

Overview

Threat actors are increasingly abusing the Node.js JavaScript runtime—a legitimate, signed developer tool—to deliver malicious payloads in targeted attacks. According to Symantec’s Threat Hunter Team, campaigns since February 2026 have hit government departments, technology companies, and hotels, exploiting the trust placed in node.exe to bypass traditional detection.

Attack Technique

• Legitimate runtime abuse: Attackers download the official Node.js installer from nodejs[.]org and use it to run malicious scripts.
• Stealth advantage: Malicious code lives in interpreted scripts, not binaries, making signature‑based detection less effective.
• Persistence: Registry Run key entries relaunch payloads at every login.
• EtherHiding technique: Used to establish long‑term access and retrieve commands/tooling.

Observed Campaigns

• Asian tech company (Mar–Jul 2026): Attackers shifted to Node.js after failed attempts to deploy AdaptixC2 and Cobalt Strike via ClickFix social engineering.
• Woodgnat/KongTuke IAB: Linked to attacks chaining Node.js with ModeloRAT, Mistic (MLTBackdoor), and malicious Chrome extensions like NexShield.
• U.S. fintech organization (May 2026): Node.js abuse paved the way for C2Looper, a Rust‑based backdoor.
• Tools observed: AsukaStealer (Node.js variant), EtherRAT, GateKeeper (.NET payload), and commodity malware.

ClickFix Connection

• ClickFix lures: Fake CAPTCHA prompts trick users into copying commands into Windows Run or Terminal.
• Blockchain evasion: Attackers use the Polygon blockchain as a dynamic address book for C2 servers, sidestepping domain/IP blocking.
• Dual victim types:
  • Legitimate businesses whose websites are injected with ClickFix scripts.
  • End‑users who land on compromised sites and execute malicious commands.

Defensive Guidance

Organizations should:

• Audit public‑facing websites for suspicious changes or injected scripts.
• Restrict browser extensions to prevent malicious add‑ons like NexShield.
• Enhance awareness training so employees recognize ClickFix‑style social engineering.
• Monitor Node.js usage: Flag unusual execution of node.exe outside developer workflows.
• Layered detection: Combine behavioral monitoring with endpoint controls to catch script‑based persistence.

Expert in the Cloud Insight

The abuse of Node.js as a malware delivery tool shows how attackers weaponize trusted developer utilities to bypass defenses. Combined with ClickFix’s blockchain‑backed persistence, these campaigns highlight the need for behavior‑focused monitoring and continuous auditing of web assets. The lesson is clear: living‑off‑the‑land techniques are evolving, and defenders must adapt to spot malicious use of legitimate tools.