Threat actors are leveraging the trusted Node.js JavaScript runtime in multiple cyber attacks as a way to deploy malicious payloads.
According to a new report published by the Symantec Threat Hunter Team today, the attack method has been put to use in attacks targeting government departments, technology companies, and hotels since February 2026.
"The technique's appeal is that node.exe (the binary that runs Node.js) is a legitimate, signed developer tool," the Broadcom-owned cybersecurity division said in a report shared with The Hacker News. "The attacker's malicious code lives in interpreted scripts rather than in a binary, making it less likely to trigger signature-based detection, while a registry Run key entry can relaunch the payload at every login."
In one intrusion observed between March 23 and July 25, 2026, targeting an unspecified Asian technology company, attackers downloaded the official Node.js installer from nodejs[.]org and used the trusted, signed runtime to deploy a malicious implant to establish long-term access and retrieve commands or tooling using a technique called EtherHiding.
The threat actors are said to have shifted to this approach after their repeated attempts to deploy AdaptixC2 and Cobalt Strike beacons on the victim's network were blocked after obtaining initial access through the ClickFix social engineering technique.
Interestingly, the technique has also been employed alongside ModeloRAT and Mistic (aka MLTBackdoor), both of which are assessed to be the work of an initial access broker named KongTuke (aka Woodgnat).
In June 2026, Symantec disclosed that Woodgnat attack chains are characterized by the abuse of "node.exe" to execute attacker JavaScript and chain PowerShell and Windows command-line tools, as well as a malicious Chrome extension named NexShield as part of a ClickFix variant dubbed CrashFix. Another tool put to use in these attacks is a .NET payload known as GateKeeper that features layered encryption and victim-fingerprinting logic.
The same modus operandi has been observed against a U.S. fintech organization, with the attack paving the way for the deployment of C2Looper, a Rust-based backdoor documented by Zscaler ThreatLabz last month. The earliest observed activity occurred on May 6, 2026, when the attackers exploited the foothold gained via ClickFix to deploy an AdaptixC2 agent and a Cobalt Strike Beacon.
It's worth noting that the installation of C2Looper took place more than two months after the initial events, although there is no evidence that the threat actors engaged in credential theft, lateral movement, or destructive operations. It's also unclear if they achieved their end goals beyond establishing the foothold using the backdoor.
"While the use of node.js and connection to the Ethereum blockchain wasn't observed in that incident, shared domains and similarities in the attack chain point to the same attackers being behind the activity," Symantec said. "It's likely we didn't see Node.js activity on this organization because the attackers were able to successfully deploy a backdoor."
The cybersecurity company said multiple threat actors are exploiting Node.js in attacks. Some of the tools used in these intrusions include a Node.js version of an information stealer named AsukaStealer, EtherRAT, and other legitimate Microsoft and command-line utilities.
"Attackers using Node.js appear happy to use a combination of both living-off-the-land and dual-use tools in their attacks, as well as commodity malware, and new tools such as Backdoor.Mistic, C2Looper, and the new version of AsukaStealer," Symantec concluded. "This indicates that attackers with a variety of skill levels may be using Node.js as it has returned to popularity."
The disclosure comes as GuidePoint Security said attackers have compromised at least 31 organizations, including e-commerce, professional services, and retail logistics businesses, through a ClickFix campaign that serves fake CAPTCHA verification prompts to visitors arriving at the compromised sites and deploys a persistent backdoor that abuses EtherHiding to locate its command-and-control (C2) infrastructure and receive commands.
The campaign is two-pronged in that it yields two different victim types: the legitimate business whose website is injected to display the ClickFix lure and unsuspecting users who land on those sites.
"Traditionally, ClickFix malware can be neutralized by blocking the attacker's C2 server, cutting off communications with infected machines," GuidePoint Security researcher Jean-Pierre Mouton said. "This campaign sidesteps that defense by using the Polygon cryptocurrency blockchain as a dynamically updatable address book."
"Because it allows for ad hoc adjustment of C2 details at scale, blocking a singular domain or IP address alone does not permanently sever attacker access. For fractions of a cent per transaction, the attacker can redirect every infected machine to a new C2 server automatically."
Over the past two years, ClickFix and its numerous variants have taken off in a big way as they aim to trick users into performing undesirable actions under the pretext of fixing an error or proving they are not bots by copying a command presented in the lure and pasting it onto the Windows Run dialog or the Windows Terminal app, effectively compromising their own systems in the process.
To combat the threat and others like it, organizations are recommended to audit public-facing websites continuously for suspicious changes or malicious scripts, restrict unapproved browser extensions, and introduce security awareness training to help employees recognize ClickFix-style social engineering tactics.