Attackers have spent 2026 abusing the trusted Node.js runtime to deliver malware, betting that a legitimate signed binary will slip past defenses built to hunt malicious executables. Symantec’s Threat Hunter Team documented the pattern in intrusions against government agencies, technology companies, and hotels since February.
The trick rests on node.exe, the signed executable that runs Node.js. Malicious logic lives in interpreted JavaScript rather than a compiled payload, which dodges signature checks, and a registry Run key can relaunch it at every login, Symantec said.
Symantec’s account of an intrusion at an unnamed Asian tech company shows the shift in practice. Attackers who entered through ClickFix lures and watched their AdaptixC2 and Cobalt Strike beacons get blocked switched to the official Node.js installer from nodejs[.]org, running an implant that pulled commands through EtherHiding, which hides malicious content on blockchain infrastructure.
Symantec links some of the activity to an initial access broker tracked as KongTuke, also known as Woodgnat, and to tools such as ModeloRAT, the Mistic backdoor, a Node.js-based stealer called AsukaStealer, and the Rust backdoor C2Looper seen against a US fintech. Defenders should treat signed dual-use runtimes with scripting activity as suspicious and review Run key persistence.
