Cyber attackers are weaponizing the legitimate Node.js JavaScript runtime to deploy malicious payloads while avoiding detection, according to a new report published today by the Symantec Threat Hunter Team. The technique has been deployed against government departments, technology firms, and hotels since February 2026. The attacks exploit the fact that node.exe is a signed, trusted developer tool, allowing malicious code to hide in interpreted scripts rather than binaries that would trigger signature-based security systems.
In one intrusion targeting an Asian technology company between March 23 and July 25, 2026, attackers downloaded the official Node.js installer from nodejs[.]org and used the legitimate runtime to deploy a persistent implant that retrieves commands through a method called EtherHiding. The threat actors switched to this approach after their attempts to deploy AdaptixC2 and Cobalt Strike beacons were repeatedly blocked following initial access via the ClickFix social engineering technique. The same technique has also been used alongside ModeloRAT and Mistic malware, both linked to an initial access broker called KongTuke. A separate attack on a U.S. fintech organization began on May 6, 2026, with ClickFix exploitation leading to the deployment of C2Looper, a Rust-based backdoor, though the installation occurred more than two months after the initial breach. Symantec disclosed in June 2026 that Woodgnat attack chains abuse node.exe to execute attacker JavaScript and chain PowerShell and Windows command-line tools, alongside a malicious Chrome extension named NexShield as part of a ClickFix variant called CrashFix.
"The technique's appeal is that node.exe (the binary that runs Node.js) is a legitimate, signed developer tool," the Broadcom-owned cybersecurity division stated. The report notes that a registry Run key entry can relaunch the payload at every login, establishing long-term persistence. The cybersecurity company concluded that attackers using Node.js "appear happy to use a combination of both living-off-the-land and dual-use tools in their attacks, as well as commodity malware," suggesting that threat actors with varying skill levels are adopting Node.js as it returns to popularity. Tools observed in these intrusions include a Node.js version of AsukaStealer information stealer, EtherRAT, and other legitimate Microsoft utilities.
The attacks work because Node.js provides a trusted execution environment that security tools recognize as legitimate software, making malicious activity harder to detect through traditional signature-based methods. The technique's effectiveness is amplified when combined with EtherHiding, which uses the Ethereum or Polygon cryptocurrency blockchain as a dynamically updatable address book for command-and-control infrastructure. GuidePoint Security reported that attackers have compromised at least 31 organizations through a ClickFix campaign serving fake CAPTCHA prompts, noting that "this campaign sidesteps that defense by using the Polygon cryptocurrency blockchain," allowing attackers to redirect infected machines to new C2 servers for fractions of a cent per transaction. The report recommends that organizations continuously audit public-facing websites for suspicious changes or malicious scripts, restrict unapproved browser extensions, and introduce security awareness training to help employees recognize ClickFix-style social engineering tactics. Blocking a single domain or IP address won't permanently sever attacker access when blockchain-based C2 redirection is in use, making prevention rather than reactive blocking the more viable defense. The rise of trusted development tools as attack vectors forces security teams to rethink detection strategies that rely on identifying malicious binaries rather than suspicious behavior. Organizations that treat all developer tools as inherently safe may find their defenses circumvented by attackers who understand that legitimacy is now a weapon, not just a shield.