Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
Attackers use Node.js runtime to deliver malware in targeted attacks.
Run Node.js?
Get an email when a reviewed story names Node.js, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Threat actors are exploiting the legitimate Node.js JavaScript runtime, node.exe, to deploy malicious payloads in targeted attacks against government, technology, and hotel sectors since February 2026. This technique bypasses signature-based detection by embedding malicious code in interpreted scripts and using registry Run keys for persistence. The attackers have also been linked to the KongTuke (Woodgnat) initial access broker, employing tools like ModeloRAT, Mistic, and GateKeeper.
The lesson from this incident
Full lessonAttackers are exploiting Node.js, a trusted and widely installed runtime, to execute malicious scripts that evade signature-based antivirus detection — a technique known as 'living-off-the-land' (LoTL). By embedding malware in interpreted JavaScript files and establishing persistence via Windows registry Run keys, the threat actors blend into normal developer workflows, making detection significantly harder. The involvement of the KongTuke initial access broker indicates a sophisticated, multi-stage supply chain of compromise targeting high-value sectors including government and technology. This matters because organizations that implicitly trust legitimate runtimes like Node.js in their allow-lists are effectively handing attackers a ready-made evasion mechanism. Relying solely on signature-based detection is insufficient against LoTL techniques.
What helps against this
How we list vendors- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
- domain — nodejs[.]org