Threat actors are increasingly exploiting the trusted **Node.js** JavaScript runtime to deploy malicious payloads in a series of cyberattacks. According to a new report from the **Symantec Threat Hunter Team**, a division of **Broadcom**, this attack method has been observed targeting government departments, technology companies, and hotels since February 2026.  ### The Appeal of Node.js as a Vector "The technique's appeal is that node.exe (the binary that runs Node.js) is a legitimate, signed developer tool," **Symantec** stated. "The attacker's malicious code lives in interpreted scripts rather than in a binary, making it less likely to trigger signature-based detection, while a registry Run key entry can relaunch the payload at every login." In one incident between March 23 and July 25, 2026, targeting an Asian technology company, attackers downloaded the official **Node.js** installer from nodejs[.]org. They then used this trusted, signed runtime to deploy a malicious implant, establishing long-term access and retrieving commands or tooling via **EtherHiding**, a technique that leverages the **Ethereum** blockchain for command-and-control (C2) infrastructure. This shift occurred after repeated attempts to deploy **AdaptixC2** and **Cobalt Strike** beacons were blocked. Initial access was gained through the **ClickFix** social engineering technique. ### Connections to Known Threat Actors and Malware This method has also been observed alongside **ModeloRAT** and **Mistic** (also known as **MLTBackdoor**), both attributed to an initial access broker named **KongTuke** (or **Woodgnat**). In June 2026, **Symantec** highlighted **Woodgnat's** modus operandi, which includes abusing "node.exe" to execute JavaScript and chain PowerShell and Windows command-line tools. Their campaigns also feature a malicious Chrome extension called **NexShield**, part of a **ClickFix** variant dubbed **CrashFix**, and a .NET payload known as **GateKeeper**. ### C2Looper and the ClickFix Campaign The same operational pattern was seen against a U.S. fintech organization, leading to the deployment of **C2Looper**, a **Rust**-based backdoor documented by **Zscaler ThreatLabz**. Initial activity on May 6, 2026, involved exploiting a **ClickFix** foothold to deploy **AdaptixC2** and a **Cobalt Strike** Beacon. While **Node.js** and **Ethereum** blockchain activity weren't directly observed in that specific incident, shared domains and similarities in the attack chain suggest the same threat actors were involved. It's speculated that **Node.js** was not necessary because a backdoor was successfully deployed. ### A Growing Trend Among Diverse Threat Actors **Symantec** notes that multiple threat actors are now exploiting **Node.js**. Tools used in these intrusions include a **Node.js** version of the information stealer **AsukaStealer**, **EtherRAT**, and various legitimate **Microsoft** and command-line utilities. "Attackers using **Node.js** appear happy to use a combination of both living-off-the-land and dual-use tools in their attacks, as well as commodity malware, and new tools such as **Backdoor.Mistic**, **C2Looper**, and the new version of **AsukaStealer**," **Symantec** concluded. "This indicates that attackers with a variety of skill levels may be using **Node.js** as it has returned to popularity." ### EtherHiding and Blockchain for C2 This disclosure coincides with **GuidePoint Security's** report on a **ClickFix** campaign that has compromised at least 31 organizations, including e-commerce, professional services, and retail logistics businesses. This campaign serves fake CAPTCHA prompts to visitors, deploying a persistent backdoor that abuses **EtherHiding** to locate its C2 infrastructure and receive commands. The campaign targets two distinct victim types: the legitimate businesses whose websites are injected with the lure, and the unsuspecting users who land on those compromised sites. "Traditionally, **ClickFix** malware can be neutralized by blocking the attacker's C2 server, cutting off communications with infected machines," said **GuidePoint Security** researcher **Jean-Pierre Mouton**. "This campaign sidesteps that defense by using the **Polygon** cryptocurrency blockchain as a dynamically updatable address book." This allows attackers to redirect every infected machine to a new C2 server automatically for fractions of a cent per transaction, making traditional C2 blocking ineffective. ### Mitigating the Threat **ClickFix** and its variants have become prevalent by tricking users into copying and pasting commands into Windows Run dialogs or Terminal apps, effectively compromising their own systems. To combat these threats, organizations are advised to: * Continuously audit public-facing websites for suspicious changes or malicious scripts. * Restrict unapproved browser extensions. * Implement security awareness training to help employees recognize **ClickFix**-style social engineering tactics.