Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
Symantec reports multiple threat actors, including KongTuke, abusing the trusted signed Node.js runtime and blockchain C2 (EtherHiding) to deliver backdoors in targeted attacks.
Symantec's Threat Hunter Team (Broadcom) reports that since February 2026 attackers have used the legitimate signed node.exe binary and interpreted scripts to deliver implants while evading signature-based detection, hitting government departments, technology companies, and hotels. One intrusion at an Asian technology firm (March 23–July 25, 2026) used ClickFix social engineering, the official Node.js installer, and EtherHiding to fetch commands via the Ethereum blockchain after AdaptixC2 and Cobalt Strike attempts were blocked. Related chains involve KongTuke (Woodgnat) using ModeloRAT, Mistic, NexShield, and GateKeeper, plus C2Looper, AsukaStealer, and EtherRAT; GuidePoint Security separately linked a fake-CAPTCHA ClickFix campaign to at least 31 compromised organizations using the Polygon blockchain as a dynamic C2 address book.
- Attackers run malicious JavaScript through signed node.exe to evade signature-based detection, persisting via registry Run keys.
- KongTuke (Woodgnat) chains pair node.exe abuse with ModeloRAT, Mistic, and the malicious NexShield Chrome extension.
- EtherHiding keeps C2 details on Ethereum/Polygon blockchains, letting attackers redirect infected machines when domains are blocked.
- GuidePoint Security tied a ClickFix fake-CAPTCHA campaign to at least 31 compromised e-commerce, services, and logistics organizations.
- Observed tooling includes AdaptixC2, Cobalt Strike, C2Looper, AsukaStealer, EtherRAT, and a .NET backdoor named GateKeeper.
- Organizations
- SymantecBroadcomZscalerGuidePoint Security
- Countries
- United States
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | nodejs.org | y, attackers downloaded the official Node.js installer from nodejs[.]org and used the trusted, signed runtime to deploy a maliciou |
From the original article
4 min read at thehackernews.com
Threat actors are leveraging the trusted Node. js JavaScript runtime in multiple cyber attacks as a way to deploy malicious payloads. According to a new report published by the Symantec Threat Hunter Team today, the attack method has been put to use in attacks targeting government departments, technology companies, and hotels since February 2026.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.