Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
- ID
- 21055
- Status
- summarized
- Published
- 03 Sep 2026, 6:43 PM
- Fetched
- 03 Sep 2026, 9:28 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/09/attackers-turn-trusted-nodejs-runtime.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 6.5
- Created
- 03 Sep 2026, 9:31 PM
- Tags
- Audience
- developerssaas_founders
What happened
Symantec's Threat Hunter Team reports that since February 2026, attackers have been downloading the official, signed Node.js installer and using node.exe to execute malicious JavaScript payloads, evading signature-based detection because the malicious code lives in interpreted scripts rather than binaries. The technique has been used against government departments, tech companies, and hotels—including an Asian tech company (March–July 2026) and a U.S. fintech—often after initial access via ClickFix social engineering, and paired with tools like ModeloRAT, Mistic, Cobalt Strike, and a Rust backdoor called C2Looper.
Why it matters
If you run Node.js in production, CI/CD, or developer workstations, you should monitor for unexpected node.exe processes executing scripts from non-standard paths, and treat the runtime itself as a potential living-off-the-land tool rather than inherently safe. The attack chain starts with ClickFix social engineering, so developer-facing training on fake verification prompts remains your first line of defense.
Discussion angle
How should teams detect and block legitimate signed binaries like node.exe being abused to run attacker-controlled scripts—what process-level monitoring or allowlisting actually works without breaking developer workflows?