Hackers Turn Trusted Node.js Runtime Into Malware Launcher in Ransomware-Linked Attacks

Cybercriminals are increasingly hijacking Node.js, the widely used JavaScript runtime, to slip malicious code past security defenses, according to new findings from the Symantec Threat Hunter Team.

Since February 2026, multiple threat actors have abused the legitimate, digitally signed tool to execute malware while evading detection, with victims spanning government departments, technology firms, and hotels across Asia and the United States.

Node. js’s appeal to attackers lies in its legitimacy. Because node. exe is a signed, trusted developer tool, security software rarely flags it as suspicious.

Node.js Runtime Into Malware Launcher

Instead of dropping a conventional malicious executable, attackers stage the genuine runtime and use it to run malicious JavaScript, keeping the harmful logic hidden inside interpreted scripts rather than a binary.