Hackers Abuse Legitimate Node.js Runtime to Hide Persistent Backdoor in Enterprise Attacks
Brief
Attackers persuade employees to accept a remote-control request during screen sharing or to open Quick Assist and provide its access code. Once inside, they use legitimate remote management and support tools to control the device.
They then run PowerShell to download a malicious MSI package from cloud storage and install it silently with Windows Installer. This is social engineering, not a Teams software flaw.
The attacker relies on users overriding visible external-contact warnings and trusting a familiar support workflow.
The MSI stages a portable Node.js runtime and an encrypted JavaScript implant under the user’s LocalAppData folder.
If Node. js is absent , the loader downloads the legitimate runtime from the official Node. js distribution. Hidden bootstrap code launched through PowerShell, cmd. exe, or WScript decrypts the implant and runs it with node. exe.