Attackers are now leveraging the trusted Node.js JavaScript runtime in a growing wave of sophisticated targeted attacks. A newly published report from Symantec’s Threat Hunter Team reveals that since February 2026, adversaries have exploited the legitimate, signed node.exebinary to execute malicious scripts stealthily, avoiding many signature-based defenses. Targets include government bodies, tech firms, and hotels. The favored tactic: register the runtime in the Windows registry so it launches at login, sustaining persistence and downloading additional tools via interpreted JavaScript.
One notable intrusion, spanned from March through July 2026 against a tech company in Asia, began when attackers—after failing to deploy their usual toolset including Cobalt Strike and AdaptixC2—downloaded Node.js from the official website. They then deployed a malicious implant that fetched commands through Ethereum blockchain gateways using the EtherHiding approach, where the actual instructions are concealed in smart contracts rather than traditional C2 domains.
The same threat actor, identified as KongTuke (aka Woodgnat), has also introduced new malware tools like ModeloRAT and a backdoor dubbed Mistic. In a U.S. fintech target, they deployed a Rust-based backdoor known as C2Looper following initial access via a ClickFix social engineering style lure. While Node.js wasn’t explicitly used in that operation, overlapping infrastructure suggests shared origins with the same group.
How ClickFix & EtherHiding Are Evolving
Central to many of these campaigns is the ClickFix technique—a social engineering lure where users are tricked into copying and pasting malicious commands under the guise of “verifying” or “fixing” something on their system. Once the payload is run manually, a chain of tools—often including PowerShell, native Windows utilities, and even Chrome extensions—are used to gain deeper access.
In a parallel development, attackers are increasingly adopting EtherHiding to make the location of C2 infrastructure dynamic. By embedding their C2 addresses in smart contracts on blockchains like Polygon or Ethereum, they can shift or update the backend without changing anything on the infected host. That makes domain or IP-based blocking much less effective. One recent campaign saw at least 31 organizations—spanning e-commerce, logistics, and professional services—fall victim to this technique.
Several high-profile tools have been involved in these attacks: AsukaStealer (including a new Node.js variant), EtherRAT, ModeloRAT, C2Looper, Backdoor.Mistic, AdaptixC2, and traditional infostealers. The attack chains mix living-off-the-land strategies, dual-use tools, and custom malware. What’s particularly worrying is that the malicious logic often lives in scripts or interpreted code rather than compiled binaries, making detection by signature engines difficult.
To counter these threats, organizations are advised to regularly scan public-facing sites for injected scripts, lock down unmanaged browser extensions, train employees to recognize social engineering tricks like ClickFix, block unintended blockchain RPC endpoints, monitor PowerShell usage, and restrict usage of legitimate tools like Node.js and Microsoft scripting to approved workflows.
Why this matters: The abuse of Node.js—long considered a developer tool of little concern to enterprise defenders—is now central to attackers’ strategies for stealth, persistence, and lateral movement. Combined with evolving social engineering like ClickFix and dynamic infrastructure via EtherHiding, these attacks are harder than ever to detect and stop.
