Symantec's Threat Hunter Team reports that since February 2026 multiple actors have abused the legitimate, signed node.exe runtime to run malicious JavaScript instead of dropping conventional executables, using a registry Run-key entry to relaunch the payload at every login; victims have included government departments, technology companies and hotels. In one intrusion at an Asian technology company (March–July 2026), ClickFix was used for initial access; after Cobalt Strike Beacon and AdaptixC2 payloads were blocked, the attackers downloaded the official Node.js installer from nodejs.org and ran an implant that contacted Ethereum blockchain gateways, most likely to fetch commands hidden in a smart contract (EtherHiding).

The same attackers compromised a U.S. fintech company with the Rust-based C2Looper backdoor. Other attacks involved ModeloRAT, believed to be developed by the initial access broker Woodgnat (aka KongTuke), and Backdoor.Mistic. Hunt for unexpected node.exe installs and Run keys, and for outbound connections to Ethereum gateways from machines that do not need developer tools. (source: Symantec)

Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Symantec Threat Hunter Team)