Threat actors are exploiting the trusted Node.js JavaScript runtime (node.exe) to deploy malicious payloads in targeted cyberattacks. The campaign, identified by the Symantec Threat Hunter Team, has been active since February 2026. Targets include government departments, technology companies, and hotels. The technique leverages the legitimacy of node.exe to bypass security controls and deliver malware. The abuse of trusted runtimes makes detection more challenging for defenders. This represents a living-off-the-land style attack leveraging legitimate software. The campaign appears targeted rather than opportunistic, focusing on specific sectors. The method's appeal lies in the trusted nature of the Node.js binary, which may evade endpoint security tools.
Threat actors are abusing the legitimate, signed Node.js runtime (node.exe) to deploy malicious payloads in targeted attacks against government departments, technology companies, hotels, and fintech organizations since at least February 2026. Because node.exe is a trusted, signed developer binary, malicious code placed in interpreted JavaScript scripts is less likely to trigger signature-based detection. Persistence is achieved via Windows registry Run keys that relaunch the payload at every login. Attackers downloaded the official Node.js installer from nodejs.org and used it to deploy implants. The technique was adopted after traditional C2 tools such as AdaptixC2 and Cobalt Strike beacons were blocked. Initial access is obtained via the ClickFix social engineering technique, which tricks users into copying and pasting malicious commands into the Windows Run dialog or Terminal. The EtherHiding technique is used to retrieve C2 commands and addresses from the Ethereum/Polygon blockchain, making C2 takedowns ineffective since attackers can update the blockchain address for fractions of a cent. Tools observed include: ModeloRAT, Mistic (MLTBackdoor), GateKeeper (.NET payload with layered encryption and victim-fingerprinting), C2Looper (Rust-based backdoor), AsukaStealer (Node.js version), EtherRAT, AdaptixC2, Cobalt Strike, and a malicious Chrome extension named NexShield (part of ClickFix variant CrashFix). Attack chains chain PowerShell and Windows command-line living-off-the-land tools alongside custom malware. A separate ClickFix campaign by GuidePoint Security compromised at least 31 organizations across e-commerce, professional services, and retail logistics using fake CAPTCHA prompts injected into legitimate websites, deploying persistent backdoors that use EtherHiding on the Polygon blockchain for C2 communication.
1. Audit public-facing websites continuously for suspicious changes or injected malicious scripts. 2. Restrict and monitor unapproved or unknown browser extensions (e.g., block NexShield and similar extensions). 3. Implement security awareness training to help employees recognize ClickFix-style social engineering tactics (fake CAPTCHA prompts, fake error fix dialogs). 4. Monitor for unusual use of node.exe (Node.js binary) in environments where it is not expected, particularly executing scripts from non-standard locations. 5. Monitor Windows registry Run keys for unauthorized entries that invoke node.exe or PowerShell. 6. Block or alert on PowerShell and command-line tool chains that follow node.exe execution. 7. Implement application allowlisting to prevent unauthorized execution of node.exe in non-developer environments. 8. Be aware that blocking a single C2 domain or IP is insufficient when EtherHiding/blockchain-based C2 is used; implement deeper behavioral detection. 9. Monitor for outbound connections to Ethereum/Polygon blockchain nodes from non-developer systems. 10. Deploy endpoint detection capable of identifying living-off-the-land and dual-use tool abuse alongside commodity malware indicators.
node.exe used to execute attacker-controlled JavaScript scripts, Registry Run key entries used for persistence to relaunch Node.js payloads at login, nodejs.org installer downloaded by threat actors during intrusion, Malicious Chrome extension: NexShield, Malware: ModeloRAT, Malware: Mistic (MLTBackdoor), Malware: GateKeeper (.NET payload), Malware: C2Looper (Rust-based backdoor), Malware: AsukaStealer (Node.js version), Malware: EtherRAT, C2 technique: EtherHiding (Ethereum/Polygon blockchain used for C2 address storage), ClickFix / CrashFix social engineering lures (fake CAPTCHA and error prompts), PowerShell and Windows command-line tool abuse in attack chains, AdaptixC2 agent deployment, Cobalt Strike Beacon deployment
