Cybercriminals are abusing the legitimate Node.js runtime to execute malicious JavaScript and establish persistent access on targeted networks. The technique has been observed since February 2026 against governments, technology companies, hotels, and financial organizations.
Attackers specifically target the signed node.exe binary rather than running custom malicious executables. By using the official runtime to interpret JavaScript payloads, they bypass many signature-based security controls.
In one documented incident against an Asian technology company, operators first attempted to deploy AdaptixC2 and Cobalt Strike. After these tools were blocked, the attackers downloaded the official Node.js installer and used it to run a persistent implant.
The malware creates a Windows registry entry to relaunch Node.js on every user login. It also establishes connections to Ethereum blockchain gateways, apparently to locate additional commands or payloads stored inside smart contracts.
The same Node.js-based approach has been linked to several implants, including ModeloRAT, Mistic, EtherRAT, and a variant of AsukaStealer. Some campaigns have been attributed to the initial-access broker Woodgnat, also known as KongTuke.
This activity has been connected to multiple ransomware operations, including those involving Qilin, Interlock, Rhysida, Akira, 8Base, Black Basta, and Embargo, although Node.js abuse is not limited to a single threat actor.
