Fast Facts
- Threat actors are leveraging trusted, signed Node.js runtimes and malicious scripts to deploy persistent backdoors like EtherHiding, avoiding detection and maintaining long-term access.
- Attack campaigns, such as ClickFix, exploit blockchain (Polygon) for dynamic C2 communications, enabling scalable, hard-to-block command-and-control infrastructure.
- Multiple tools, including custom malware like AsukaStealer, EtherRAT, and C2Looper, are used in complex multi-stage attacks to steal data, establish footholds, and evade traditional defenses.
Threat, Attack Techniques, and Targets
Threat actors are now using the trusted Node.js JavaScript runtime to deliver malware. They take advantage of the fact that node.exe, which runs Node.js, is a legitimate and signed developer tool. This makes it easier for attackers to hide malicious code inside scripts, reducing the chances of detection. They often download the official Node.js installer from the trusted website and use it to deploy malicious implants. This technique allows them to stay hidden and maintain long-term access to victim systems.
Since February 2026, the attackers have targeted various organizations. These include government agencies, technology companies, hotels, and financial organizations. They also use social engineering techniques like ClickFix to gain initial access. After establishing a foothold, attackers deploy different types of malware. For example, they use backdoors like C2Looper, information stealers like AsukaStealer, and remote access tools such as EtherRAT. Sometimes, they utilize legitimate tools like command-line utilities and Microsoft programs to carry out their attacks. These actions show a clear pattern of using Node.js as a delivery platform for multiple malicious tools.
Impact, Security Implications, and Remediation Guidance
The use of Node.js for malware delivery poses serious security risks. It can help attackers maintain long-term access, steal sensitive data, or manipulate systems remotely. Because the malicious code runs within trusted environments, it can avoid detection by traditional security measures. This makes organizations vulnerable to persistent threats and data breaches.
Currently, specific remediation guidance is not provided here. Organizations should seek advice from their cybersecurity vendors or relevant authorities. It is important to continuously monitor and audit public websites for suspicious scripts or changes. Restrict the use of unapproved browser extensions and implement security awareness training for staff. These steps help reduce the risk of social engineering attacks and malware infections.
Stay Ahead with the Latest Tech Trends
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Stay inspired by the vast knowledge available on Wikipedia.
ThreatIntel-V1
