The core of the attack relies on the inherent legitimacy of node.exe, the standard executable for the Node.js JavaScript runtime. Because this binary is a trusted, signed component present in many enterprise environments, security tools often fail to flag its execution as suspicious. The attackers exploit this trust by using node.exe to run malicious JavaScript code directly, effectively turning a benign development tool into a malware loader.

• Primary targets: Government agencies, technology firms, and the hospitality sector.
• Active timeframe: Observed in the wild since February 2026.
• Execution method: Leverages the legitimate node.exe binary to interpret and execute attacker-controlled JavaScript.

This approach is particularly dangerous because it blurs the line between legitimate administrative activity and malicious behavior. The malicious JavaScript can be delivered via various means, such as a downloadable file or a script fetched remotely, and then executed locally using the already-present Node.js runtime. This reduces the need for complex exploit chains or the dropping of custom, easily-detected binaries on the disk.

While the report does not provide specific indicators of compromise, organizations should review their security policies regarding the execution of scripting runtimes, especially where they are not strictly required for business operations.

Source: The Hacker News

Are you reviewing your environment for unsanctioned use of Node.js, or is this a runtime your security team currently treats as fully trusted?