ATTACKERS are exploiting the Node[.]js runtime to slip past endpoint defenses across global corporate networks, with multiple campaigns observed since February 2026. The Symantec Threat Hunter Team and Zscaler outline that technology firms, hotels and financial institutions have been targeted, with intrusions maintaining stealthy footholds linked to ransomware groups.
A notable tactic is abusing the legitimate node[.]exe binary, which carries a valid digital signature, enabling security tools to allow its execution before suspicious activity is flagged.
The intrusion chain begins with initial command execution via PowerShell, followed by persistence through a background service and the download of additional command frameworks. When defenders detect standard payloads, attackers have adapted by shipping a native addon paired with the signed runtime to perform system interactions and by creating a Windows registry Run key to restart the runtime in a headless session at user logon.
The payload typically uses interpreted scripts to conceal its core code, evading traditional signature scanners. In at least one case at a US fintech company, the same infrastructure delivered a Rust-based backdoor known as C2Looper, which has been discussed by Zscaler as a precursor to ransomware.
For command-and-control, the malware contacts external channels and, in an Asian technology intrusion, reached Ethereum blockchain gateway services daily, employing EtherHiding to conceal addresses inside public smart contracts before shifting communications to cloud serverless domains. Defence guidance calls for monitoring unexpected installations of developer tools, Run keys, and unusual outbound connections, as well as scrutiny of repeated blockchain gateway requests and serverless domains. No CVEs are explicitly cited in the article.