Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
Summary: Symantec's Threat Hunter Team reports that attackers have used the signed Node.js runtime, node.exe, to deploy malicious payloads against government departments, technology companies, and hotels since February 2026, with malicious code placed in interpreted scripts and a registry Run key relaunching the payload at each login. In one intrusion against an Asian technology company between March 23 and July 25, 2026, attackers downloaded the official installer from nodejs.org after ClickFix social engineering gave them initial access, then used the runtime to deploy an implant that retrieves commands via EtherHiding.
What you should know: The binary doing the work is legitimate and signed, and the payload lives in scripts rather than a binary, so signature-based detection has little to match on. GuidePoint Security separately reports at least 31 organizations compromised through a ClickFix campaign that uses the Polygon blockchain as a dynamically updatable address book, meaning blocking a single domain or IP no longer severs attacker access.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026