Attackers use signed Node.js runtime to deliver malware

Threat actors have used the legitimate Node.js runtime to deploy malicious payloads in attacks on government departments, technology companies and hotels since February 2026, according to Symantec's Threat Hunter Team. In one intrusion targeting an Asian technology company, attackers downloaded the official Node.js installer and used its signed runtime to run an implant and retrieve commands or tools. The technique places malicious code in interpreted scripts and can use a registry Run key to relaunch it at login. Related activity has also targeted a U.S. fintech organization.