Node.js attacks are turning a legitimate JavaScript runtime into a discreet malware launcher. Findings reported on 3 September 2026 describe multiple threat actors using the trusted, digitally signed software to execute malicious scripts and establish persistence.
The activity has been observed since February 2026 across government departments, technology companies and hotels in Asia and the United States. Some incidents have also been connected to tools and infrastructure associated with ransomware staging, credential theft and cryptocurrency theft.
How Node.js attacks abuse a trusted runtime
Node.js is a widely used runtime that allows JavaScript to execute outside a web browser. The software itself is legitimate, and its node.exe executable is digitally signed. This makes it useful to developers, but it can also help attackers make malicious activity look less suspicious to security tools.
Rather than delivering a conventional malicious executable, the attackers install or stage a genuine copy of Node.js. They then instruct node.exe to run malicious JavaScript containing the implant’s core logic. The harmful behaviour is therefore placed inside an interpreted script instead of an unfamiliar executable file.
This approach is not a vulnerability in Node.js, and the report does not identify a vulnerable product version that requires a security patch. The technique instead abuses the runtime’s intended ability to execute JavaScript. Any installed version capable of running the attacker’s script could potentially serve as the launcher, although the reported incidents do not specify individual versions.
Once active, the malware can create persistence through a Windows registry Run key. This causes Node.js and its associated script to start when the affected user logs in, allowing the implant to return after a restart without relying on an obviously malicious service or executable.
Node.js attacks followed blocked C2 deployments
Asian technology company targeted
One of the clearest examples involved an Asian technology company. Attackers initially attempted to deploy AdaptixC2 agents and a Cobalt Strike Beacon, but those attempts were repeatedly blocked. They subsequently changed tactics and downloaded the official Node.js installer directly from nodejs.org.
Using the genuine installer gave the attackers a legitimate execution environment already trusted by many defensive products. They used it to run an implant that communicated with Ethereum blockchain gateways. This method, known as EtherHiding, stores or retrieves instructions and payload information through blockchain smart contracts.
Blockchain-based communication can complicate detection and disruption. Instead of connecting only to an easily blocked command-and-control server, the implant can make outbound requests to public blockchain remote procedure call endpoints. Such traffic may appear legitimate unless it is unusual for the specific device or user.
US fintech intrusion linked by infrastructure
The same threat actor was also connected to an intrusion at a US financial technology company. In that case, the attackers deployed C2Looper, a Rust-based backdoor previously assessed as a tool that may establish footholds for ransomware operators before lateral movement.
Researchers linked the Asian technology and US fintech incidents through shared command-and-control infrastructure. This included the domain datalayerservice. The common infrastructure, combined with related tooling and methods, indicates that one actor was responsible for both intrusions.
These incidents show that Node.js attacks can form one part of a broader intrusion rather than acting as a standalone campaign. The runtime provides execution and persistence, while tools such as C2Looper, AdaptixC2 or Cobalt Strike can support remote control, discovery and subsequent movement through a network.
Ransomware-linked malware seen in the campaign
Symantec’s Threat Hunter Team found that the technique was not limited to one group. Since February 2026, multiple actors with different skill levels and objectives have adopted Node.js abuse. Their apparent goals have ranged from ransomware preparation to stealing credentials and cryptocurrency.
Other incidents combined Node.js attacks with ModeloRAT. This malware is believed to have been created by an initial access broker known as Woodgnat or KongTuke. Initial access brokers compromise organisations and may then sell or transfer that access to other criminals.
Woodgnat or KongTuke has been linked to several ransomware families. The reported associations include:
- Qilin
- Interlock
- Rhysida
- Akira
- 8Base
- Black Basta
- Embargo
The presence of ModeloRAT does not mean every affected organisation suffered ransomware encryption. It does, however, place some of the observed activity within an ecosystem that can provide the access and remote control needed before a ransomware deployment.
Researchers also observed a new Node.js edition of AsukaStealer targeting hotels in Asia. AsukaStealer is designed for information theft, demonstrating that the runtime is being adopted for objectives beyond ransomware. EtherRAT, a remote access trojan that also relies on blockchain infrastructure, appeared in related activity.
The collection of tools indicates an active technique rather than a single malware family or tightly defined campaign. Attackers can change the JavaScript payload while retaining Node.js as a legitimate execution layer, which gives them flexibility if one implant or command channel is detected.
Current exploitation status and affected systems
The findings describe multiple confirmed incidents beginning in February 2026, so the activity represents exploitation observed in real environments rather than a theoretical technique. The report does not provide a victim count, a complete geographical breakdown or specific Node.js version numbers.
Windows systems are particularly relevant because the observed attackers used registry Run keys for persistence. Risk is likely to be more visible on endpoints and servers where Node.js is not normally required, such as non-development workstations, hotel systems or administrative devices.
Legitimate Node.js use is common in technology environments, meaning defenders cannot treat every execution as malicious. Context is essential, including how the runtime was installed, which script it launched, the parent process, the user account involved and the destination of subsequent network connections.
What organisations should check now
Organisations should focus on indicators specific to these Node.js attacks rather than blocking the runtime indiscriminately. Development teams may depend on Node.js, and broad prevention could disrupt legitimate applications without identifying compromised scripts.
- Identify unexpected Node.js installations, particularly recent downloads from nodejs.org on systems that are not used for development.
- Review Windows Run keys for node.exe commands, unfamiliar JavaScript files or scripts launched from temporary and user-writable directories.
- Examine node.exe process trees for unusual parent processes, command-line arguments and network activity.
- Investigate outbound connections to Ethereum gateways and other blockchain RPC endpoints when such traffic has no approved business purpose.
- Correlate these findings with traces of AdaptixC2, Cobalt Strike, C2Looper, ModeloRAT, AsukaStealer and EtherRAT.
The key distinction is between expected developer activity and a newly introduced runtime being used as an execution proxy. Monitoring installation context, persistence changes and blockchain traffic can help expose the malicious script even when node.exe itself is genuine and signed.
Originally reported by cybersecuritynews.com.
