Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks

Threat actors are using the Node.js JavaScript runtime to deliver malicious payloads in targeted attacks. This method has been used in attacks on government departments, technology companies, and hotels since February 2026. The attackers are leveraging the trusted nature of the Node.js runtime to carry out these attacks. The Node.js executable, node.exe, is being utilized in this technique, which appears to be appealing to the attackers. The attacks have been ongoing for a few months, with the Symantec Threat Hunter Team recently publishing a report on the matter. The report highlights the use of this technique in multiple cyber attacks.