Node.js Abuses Resurface as Attackers Evade Detection

Node.js is an open-source JavaScript runtime environment that has made a comeback as a preferred technique for attackers in recent months. Since February 2026, multiple actors have been observed using this method to compromise various organizations, including government departments, technology companies, and hotels.

The appeal of Node.js lies in its legitimacy as a signed developer tool. Malicious code is often embedded in interpreted scripts rather than binaries, making it less likely to trigger signature-based detection. Attackers can also use the node.exe registry Run key entry to relaunch payloads at every login, ensuring persistence.

One notable example of Node.js abuse was observed in an attack on an Asian technology company between March and July 2026. The attackers downloaded the official Node.js installer from nodejs.org and used it to execute a malicious implant that contacted Ethereum blockchain gateways, likely to retrieve commands or payloads hidden in smart contracts.

Other attacks involved ModeloRAT, believed to be developed by Woodgnat (aka KongTuke), which has been linked to multiple ransomware families. The same attackers also compromised a U.S. fintech company, deploying a Rust-based backdoor called C2Looper, previously documented by Zscaler in August 2026.