As reported by The Hacker News, Symantec's Threat Hunter Team has documented a campaign active since February 2026 in which threat actors abuse the legitimate, code-signed node.exe binary to execute malicious JavaScript payloads. The technique has been observed across government, technology, hospitality, and fintech sectors, often chained with ClickFix social engineering and tools like AdaptixC2, Cobalt Strike, ModeloRAT, and the Rust-based C2Looper backdoor.

Threat Alert: As reported by The Hacker News, Symantec's Threat Hunter Team has documented a campaign active since February 2026 in which threat actors abuse the legitimate, code-signed node.exe binary to execute malicious JavaScript payloads.

Why This Technique Works — and Why It's Spreading

The core appeal for attackers is simple: node.exe is a Microsoft-trusted, digitally signed binary distributed officially by the Node.js Foundation. When it executes JavaScript from disk or memory, the actual malicious logic lives in plaintext or lightly obfuscated interpreted code — not in a compiled PE that EDR engines can fingerprint. This creates a detection gap that signature-based and many heuristic-based defenses struggle to close.

What makes this campaign particularly notable is the operational patience and adaptability on display. When traditional C2 frameworks like Cobalt Strike and AdaptixC2 were blocked, the operators pivoted to Node.js-delivered implants rather than abandoning the intrusion. The two-month dwell time before C2Looper deployment at the fintech target suggests a deliberate, methodical approach — not opportunistic smash-and-grab.

The threat isn't a new vulnerability in Node.js. It's the abuse of trust: signed binaries executing untrusted code paths that defenders haven't instrumented.

The Broader LOLBin Problem

This is part of a well-documented shift toward living-off-the-land techniques. We've seen the same pattern with mshta.exe, certutil.exe, rundll32.exe, and PowerShell. Node.js joins a growing list of developer tools — including Python, Go, and .NET runtime binaries — that are pre-installed or readily available in enterprise environments and carry implicit trust.

The involvement of initial access broker KongTuke / Woodgnat, alongside a toolkit spanning ModeloRAT, Mistic/MLTBackdoor, the NexShield malicious Chrome extension, and the .NET-based GateKeeper payload, suggests a commercialized attack supply chain. IABs sell access; downstream operators bring their own tooling. Node.js is simply the latest delivery rail.

Who Is Most Exposed

Who Is Most Exposed
Developer-heavy environments — tech companies, fintechs, and any organization where Node.js is legitimately installed or where users have local admin rights to install it
Hospitality and government — sectors already identified as targets, likely due to lower security maturity at edge endpoints
Organizations relying primarily on signature-based AV — these defenses are structurally blind to interpreted payload execution via trusted binaries
ClickFix-vulnerable workflows — help desks, customer support, and any team that regularly interacts with browser-based prompts or fake CAPTCHA flows

Shield53 Recommendations

Immediate Actions

  • Inventory node.exe deployments — identify every endpoint where Node.js is installed. If it's not a business requirement, remove it. If it is, restrict execution to approved paths via AppLocker or Windows Defender Application Control (WDAC)
  • Deploy behavioral detection rules — alert on node.exe spawning from unexpected parent processes (browsers, Office apps, PowerShell) or executing JavaScript from user-writable directories like %AppData%, %Temp%, or %LocalAppData%
  • Hunt for persistence — search all endpoints for registry Run keys referencing node.exe and for scheduled tasks that invoke the binary with script arguments
  • Block ClickFix entry points — train staff on fake CAPTCHA / browser-update social engineering patterns. Consider restricting clipboard write access from untrusted web content via browser policy

Strategic Hardening

  • Enable script block logging for PowerShell and configure EDR to inspect child process command lines from all signed developer-tool binaries — not just traditional LOLBins
  • Adopt deny-by-default application allowlisting — WDAC policies that permit node.exe only from approved installation paths and block execution of scripts outside signed package directories
  • Monitor outbound connections from node.exe — legitimate Node.js services typically bind known ports. Unexpected C2-style beaconing from the binary is a high-fidelity indicator
  • Integrate threat intel on KongTuke/Woodgnat IOCs — including AdaptixC2, C2Looper, ModeloRAT, Mistic, and NexShield extension hashes and network indicators into SIEM detection content

The takeaway for security leaders: trust in signed binaries is not a control — it's an assumption attackers are now systematically exploiting. Your detection strategy must assume that any runtime capable of executing interpreted code can and will be weaponized. Behavioral baselining, parent-child process anomaly detection, and script content inspection are no longer optional layers.