Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
Threat actors are weaponizing the legitimate, signed Node.js runtime (node.exe) to execute malicious JavaScript payloads, bypassing signature-based detection since the code lives in interpreted scripts rather than binaries The technique has been observed in targeted attacks against government departments, technology companies, hotels, and fintech organizations since February 2026, often chained with ClickFix social engineering Attackers use registry Run key entries to persistently relaunch Node.
Analysis
TL;DR
- Threat actors are weaponizing the legitimate, signed Node.js runtime (node.exe) to execute malicious JavaScript payloads, bypassing signature-based detection since the code lives in interpreted scripts rather than binaries
- The technique has been observed in targeted attacks against government departments, technology companies, hotels, and fintech organizations since February 2026, often chained with ClickFix social engineering
- Attackers use registry Run key entries to persistently relaunch Node.js-based payloads at every login, establishing long-term access through tools like EtherHiding, C2Looper, and Backdoor.Mistic
- The same modus operandi is linked to initial access broker KongTuke (Woodgnat), who combines living-off-the-land techniques with commodity and novel malware
- A parallel ClickFix campaign leverages the Polygon blockchain as a dynamically updatable C2 address book, allowing attackers to redirect all infected machines to new servers for fractions of a cent per transaction
Why It Matters
This represents a significant shift in attacker strategy, exploiting the widespread trust and legitimate signing of Node.js to evade traditional endpoint detection mechanisms. For AI and security practitioners, it highlights how developer tooling ecosystems can become attack surfaces when threat actors combine social engineering with living-off-the-land techniques. The integration of blockchain for C2 resilience also signals an evolving threat landscape where decentralized infrastructure complicates traditional network defense approaches.
Technical Details
- Node.js Abuse: Attackers download the official Node.js installer from nodejs.org and use the signed node.exe binary to execute malicious JavaScript scripts stored in interpreted form, avoiding signature-based detection. Registry Run key entries ensure payload relaunch at every system login.
- Attack Chains: Initial access is typically gained through ClickFix social engineering (fake CAPTCHA prompts). Post-compromise, attackers deploy tools such as EtherHiding (C2 communication via Ethereum blockchain), C2Looper (Rust-based backdoor), Backdoor.Mistic/ModeloRAT, AsukaStealer, and GateKeeper (.NET payload with layered encryption and victim fingerprinting).
- Blockchain-Enabled C2 Resilience: A GuidePoint Security-tracked ClickFix campaign uses the Polygon cryptocurrency blockchain as a dynamically updatable address book for C2 infrastructure, allowing attackers to redirect all infected machines to new servers at negligible cost, rendering traditional domain/IP blocking ineffective.
- Multi-Actor Involvement: The attack patterns are linked to initial access broker KongTuke (Woodgnat), with shared domains and attack chain similarities indicating coordinated operations across multiple threat actors employing both living-off-the-land techniques and dual-use tools.
- Target Sectors and Timeline: Observed intrusions span from February 2026 onward, targeting government, technology, hospitality, and fintech sectors, with at least 31 organizations compromised through the blockchain-enhanced ClickFix campaign.
Industry Insight
- Security teams should treat legitimate developer runtimes like Node.js as potential attack vectors and implement application control policies, monitoring for suspicious node.exe execution patterns and unapproved JavaScript files rather than relying solely on signature-based detection.
- The use of blockchain for C2 resilience represents an emerging trend that will likely expand across threat groups; defenders need to incorporate blockchain monitoring and anomaly detection into their threat hunting frameworks to identify decentralized C2 communication patterns.
- Organizations should prioritize continuous auditing of public-facing websites for injected malicious scripts, enforce strict browser extension policies, and invest in security awareness training focused on recognizing ClickFix-style social engineering, as user interaction remains the primary initial access vector in these campaigns.
Disclaimer: The above content is generated by AI and is for reference only.