Threat actors are using the reliable Node.js JavaScript runtime to launch malicious payloads in a number of cyberattacks.
The assault approach has been used in attacks on government agencies, IT companies, and hotels since February 2026, according to a new report released today by the Symantec Threat Hunter Team.
According to a research published with The Hacker News by the Broadcom-owned cybersecurity division, the technique’s attraction stems from the fact that node.exe, the binary that runs Node.js, is a valid, signed developer tool. “A registry Run key entry can reload the payload at each login, but the attacker’s malicious code resides in interpreted scripts rather than a binary, making it less likely to trigger signature-based detection.
An unidentified Asian technology company was the target of one intrusion that was discovered between March 23 and July 25, 2026. The attackers downloaded the official Node.js installer from nodejs[.]org and used the trusted, signed runtime to install a malicious implant that established long-term access and retrieved commands read more about Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
when gaining initial access with the ClickFix social engineering technique, the threat actors reportedly switched to this strategy when their repeated attempts read more about Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.