Affected Systems

Organizations using Node.js in their environments, particularly government departments, technology companies, hotels, fintech, e-commerce, professional services, and retail logistics. Attack campaign active since February 2026 targeting primarily Asian and U.S. organizations.

Exploitation Status

Active exploitation confirmed since February 2026. Multiple threat actors deploying various malware families including AdaptixC2, Cobalt Strike, ModeloRAT, Mistic, C2Looper, EtherRAT, and AsukaStealer. At least 31 organizations confirmed compromised. Initial access primarily via ClickFix social engineering technique.

Business Impact

Attackers leverage signed, legitimate node.exe binary to evade signature-based detection and establish persistent access via registry Run keys. Malicious code resides in interpreted JavaScript rather than binaries, reducing detection likelihood. EtherHiding technique uses Ethereum/Polygon blockchain for C2 infrastructure discovery, making traditional domain/IP blocking ineffective. Threat actors demonstrate persistence over months (2+ months observed in one case) but no confirmed data exfiltration, lateral movement, or destructive operations reported yet. Multiple skill-level actors adopting this technique indicates growing trend.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Audit all Node.js installations and monitor node.exe process execution for suspicious parent processes or command-line arguments, particularly those launched via registry Run keys or scheduled tasks
  • Implement application whitelisting or EDR behavioral rules to detect node.exe executing scripts from unusual locations (user temp directories, AppData) or with network connections to blockchain RPC endpoints
  • Block or heavily restrict ClickFix-style social engineering by disabling direct execution from Windows Run dialog and PowerShell for standard users; enforce SmartScreen and mark-of-the-web protections
  • Monitor outbound connections to Ethereum and Polygon blockchain nodes (common RPC endpoints like Infura, Alchemy) from workstations as potential C2 channel indicators
  • Conduct security awareness training focused on fake CAPTCHA prompts and any instructions asking users to paste commands into Windows Run or Terminal applications
  • Audit public-facing websites continuously for injected malicious JavaScript and restrict installation of unapproved browser extensions via Group Policy