Affected Systems

Organizations using Node.js in their environments, particularly government departments, technology companies, hotels, fintech, e-commerce, professional services, and retail logistics. Attack campaign active since February 2026 targeting multiple sectors globally, with confirmed incidents in Asia and United States.

Exploitation Status

Active exploitation confirmed since February 2026. Multiple threat actors actively using Node.js (node.exe) to deploy malware including ModeloRAT, Mistic, C2Looper, EtherRAT, and AsukaStealer. Initial access primarily via ClickFix social engineering technique. At least 31 organizations confirmed compromised through related ClickFix campaign using EtherHiding C2 technique via Polygon blockchain.

Business Impact

Attackers download legitimate Node.js installer from nodejs.org and use the signed node.exe binary to execute malicious JavaScript payloads, bypassing signature-based detection. Persistence achieved via registry Run keys. The technique enables long-term access, command execution, and backdoor deployment. EtherHiding technique uses Ethereum/Polygon blockchain for C2 infrastructure, making traditional domain/IP blocking ineffective. Threat actor KongTuke (Woodgnat) and multiple other groups actively exploiting this method. No CVSS score applicable (campaign, not vulnerability).

Urgency

🟠 Within 24 hours

Recommended Actions

  • Monitor for unexpected node.exe execution, especially with registry Run key persistence or launched from unusual parent processes (e.g., PowerShell, cmd.exe from browser contexts)
  • Audit public-facing websites continuously for malicious JavaScript injection and fake CAPTCHA/ClickFix lures; implement file integrity monitoring on web assets
  • Block or restrict execution of node.exe via application control policies (AppLocker, Windows Defender Application Control) unless required for legitimate development workflows
  • Deploy security awareness training focused on ClickFix social engineering tactics that trick users into running commands via Windows Run dialog or Terminal
  • Monitor network traffic for blockchain API queries to Ethereum/Polygon nodes (e.g., etherscan.io, polygonscan.com) from non-development endpoints as potential EtherHiding C2 activity