Attackers Weaponize Node.js Runtime for Stealthy Malware Deployment
Cybercriminals are increasingly abusing the legitimate Node.js runtime to execute malware and evade security defenses, a technique observed since February 2026.
Threat actors are increasingly turning to the widely-used Node.js JavaScript runtime as a stealthy method to deploy malware, bypassing traditional security measures. Since February 2026, multiple threat groups have been observed abusing the digitally signed and trusted node.exe to execute malicious JavaScript code, effectively hiding harmful logic within interpreted scripts rather than easily detectable binary executables. This technique allows attackers to leverage a legitimate tool, making it significantly harder for security software to flag suspicious activity.
The appeal of Node.js to attackers lies in its inherent trustworthiness. Because node.exe is a signed, legitimate developer tool, it often bypasses the stringent checks applied to unknown or unsigned executables. Attackers achieve persistence by registering the Node.js runtime in a Windows registry Run key, ensuring that malicious scripts are automatically executed every time a user logs into an infected system.
One notable campaign involved attackers targeting an Asian technology company. After repeated failures to deploy conventional malware like AdaptixC2 agents and Cobalt Strike Beacon, the threat actors resorted to downloading the official Node.js installer directly from the official website. They then used the legitimate runtime to execute an implant that communicated with Ethereum blockchain gateways, employing a technique known as EtherHiding. This method conceals commands or payloads within smart contracts on the blockchain, adding another layer of obfuscation.
This same threat actor group also breached a U.S. fintech firm, deploying a Rust-based backdoor named C2Looper. This backdoor has been previously documented as malware used by initial access brokers to establish footholds for subsequent ransomware deployment and lateral movement. Evidence, including shared command-and-control infrastructure such as the domain datalayerservice, links these two distinct intrusions to a single, sophisticated actor.
The abuse of Node.js is not confined to a single group or objective. Symantec's analysis indicates that various actors, with differing skill sets and goals, have adopted this technique. These range from deploying precursors for ransomware attacks to facilitating credential theft and cryptocurrency exfiltration. Other observed malware families deployed in conjunction with Node.js abuse include a new Node.js version of AsukaStealer, targeting hotels in Asia, and EtherRAT, another remote access trojan that relies on blockchain communication.
Furthermore, the Node.js abuse has been linked to the ModeloRAT tool, believed to be developed by an initial access broker known as Woodgnat or KongTuke. This broker has been associated with numerous ransomware families, including Qilin, Interlock, Rhysida, Akira, 8Base, Black Basta, and Embargo, highlighting the broad impact of compromised initial access.
Security teams are advised to remain vigilant for unusual Node.js installations on systems that do not typically require developer tools. Monitoring for unexpected registry entries in Run keys and scrutinizing outbound network traffic to blockchain RPC endpoints, such as Ethereum gateways, are crucial detection strategies. The resurgence of this older technique underscores a persistent trend where attackers continue to exploit reliable methods that evade modern defenses.
As Symantec's researchers emphasize, this tactic serves as a stark reminder that attackers rarely abandon methods that prove effective. The ability to hide malicious operations within a trusted, signed runtime presents a significant challenge for defenders, necessitating adaptive security postures and continuous monitoring for anomalous behavior.
This new report details how attackers are specifically leveraging the Node.js runtime (node.exe) to deploy malware, including AdaptixC2, Cobalt Strike, ModeloRAT, and Mistic, in targeted attacks against government, tech, and hotel sectors since February 2026. The technique abuses the trusted nature of the runtime to bypass security measures, with observed intrusions occurring between March and July 2026, and also notes connections to the ClickFix social engineering technique and the KongTuke initial access broker.