Node.js Abused as Malware Delivery Tool in ClickFix Attacks

Security researchers at Symantec's Threat Hunter Team have published a report describing how attackers are abusing the Node.js JavaScript runtime to deliver hidden malware. Node.js is a popular free platform that lets developers run JavaScript code outside a web browser, and the file that launches it, node.exe, carries a valid digital signature from the developer. Because that file is a trusted, legitimate developer tool, security software is less likely to flag it. The Symantec researchers say the technique has been used against government departments, technology companies, and hotels since February 2026.

The trick works because the malicious code does not live inside the node.exe binary itself. Instead, attackers place their code in JavaScript files that Node.js interprets and runs. That approach is less likely to trigger signature-based detection, which normally looks for known malicious programs. The attackers also add an entry to the Windows registry Run key, a setting that automatically starts a program every time a user logs in, so the malicious script gets relaunched after each reboot. In one intrusion observed between March 23 and July 25, 2026, against an unspecified Asian technology company, the attackers downloaded the official Node.js installer directly from nodejs.org and used the signed runtime to deploy a malicious implant. That implant gave the attackers long-term access and let them retrieve further commands and tools using a technique called EtherHiding, which stores the address of the attacker's control server inside the Ethereum blockchain, a public digital ledger, so the address can be changed without updating the malware itself.

Symantec reports that the attackers shifted to Node.js after their earlier attempts to deploy AdaptixC2 and Cobalt Strike beacons were blocked. AdaptixC2 and Cobalt Strike are commercial penetration testing tools that attackers commonly misuse to control infected computers. The attackers had already gained initial access using ClickFix, a social engineering trick that shows victims a fake error or CAPTCHA prompt and asks them to copy a command and paste it into the Windows Run dialog or Terminal. ClickFix tricks users into installing malware on their own machines. The same Node.js technique has also been used together with malware families called ModeloRAT and Mistic, also known as MLTBackdoor. Symantec assesses these tools as the work of an initial access broker named KongTuke, also known as Woodgnat. An initial access broker is a criminal group that breaks into networks and sells that access to other attackers. In June 2026, Symantec disclosed that Woodgnat attack chains abuse node.exe to run attacker JavaScript and then chain together PowerShell and Windows command-line tools. They also use a malicious Chrome extension called NexShield as part of a ClickFix variant named CrashFix. Another tool used in these attacks is a .NET payload called GateKeeper that uses layered encryption and checks details about the victim's system before running.

A similar attack chain was observed against a U.S. fintech organization. That intrusion led to the deployment of C2Looper, a backdoor written in the Rust programming language that was documented by Zscaler ThreatLabz last month. The earliest activity happened on May 6, 2026, when the attackers used their ClickFix foothold to install an AdaptixC2 agent and a Cobalt Strike Beacon. The C2Looper backdoor was installed more than two months later. Symantec found no evidence that the attackers stole credentials, moved to other systems on the network, or carried out destructive actions, and it is unclear whether they achieved any goal beyond establishing a persistent foothold.

Symantec notes that multiple threat actors are exploiting Node.js. Tools seen in these intrusions include a Node.js version of an information-stealing program called AsukaStealer, a remote access tool called EtherRAT, and legitimate Microsoft and command-line utilities. The researchers say attackers are happy to mix living-off-the-land techniques, which abuse tools already installed on the victim's computer, with dual-use tools and commodity malware. They conclude that attackers with a variety of skill levels may be using Node.js because the runtime has returned to popularity.

In a separate but related disclosure, GuidePoint Security says attackers have compromised at least 31 organizations, including e-commerce, professional services, and retail logistics businesses, through a ClickFix campaign. That campaign injects fake CAPTCHA verification prompts into legitimate websites. When a visitor arrives at a compromised site, the site displays a prompt that asks the visitor to prove they are not a robot by copying and pasting a command. If the visitor follows the instructions, a persistent backdoor is installed. That backdoor uses EtherHiding to find its command-and-control server on the Ethereum blockchain. GuidePoint researcher Jean-Pierre Mouton explained that traditional ClickFix malware can be stopped by blocking the attacker's control server, but this campaign sidesteps that defense by using the Polygon cryptocurrency blockchain as a dynamically updatable address book. An attacker can change the address of the control server by making a very small payment on the blockchain, so blocking one domain or IP address does not permanently cut off access.

Over the past two years, ClickFix and its variants have spread widely. The attack works because it asks users to do something that looks harmless, like fixing an error or passing a bot check, but the pasted command actually downloads and runs malware. GuidePoint and Symantec recommend that organizations audit their public-facing websites continuously for suspicious changes or malicious scripts, restrict unapproved browser extensions, and train employees to recognize ClickFix-style social engineering. For website owners, keeping a site free of injected scripts is essential, because a compromised site becomes the first stage of someone else's infection. Using a managed WordPress hosting service such as AEU Hosting (https://albhosting.eu) can give website owners an extra layer of continuous security monitoring to help keep their public-facing sites clean.