Hackers Are Hiding Malware Inside Node.js, and Windows Sees Nothing Wrong
Symantec says attackers have been abusing the legitimate Node.js runtime since February 2026 to slip past defences at governments, tech firms and hotels.
Key points
- Symantec's Threat Hunter Team says attackers have been abusing Node.js, a legitimate programming tool made by the OpenJS Foundation, to run malware since February 2026.
- The technique works because node.exe, the Node.js program file, is digitally signed and trusted by Windows, so security tools rarely flag it.
- Victims so far include government departments, technology companies and hotel chains.
- The malicious code is written in JavaScript, the same language that powers most websites, which makes it easy to hide and to change.
- Defenders are being told to watch for node.exe running in odd places, such as user folders or temporary directories.
Attackers have found a comfortable new hiding place, and it is one almost every IT team already trusts.
Symantec's Threat Hunter Team, part of Broadcom, says criminals have been quietly using Node.js to deliver malware since February 2026. Node.js is a widely used piece of software from the OpenJS Foundation that lets developers run JavaScript, the language behind most modern websites, directly on a server or laptop. It sits on millions of machines. It is signed by a trusted publisher. Windows almost never questions it.
That, in practice, is the whole point of the attack.
What are the hackers actually doing?
They are using a legitimate program, node.exe, to run their own malicious JavaScript code. Because node.exe is signed and expected on developer and server machines, antivirus tools tend to leave it alone. The attackers pair it with a script they control, and the script does the damage.
The report, first covered by The Hacker News, describes campaigns aimed at government departments, technology firms and hotel groups. The exact way each victim gets infected varies, but the pattern is consistent: get node.exe onto the machine (or use the one already there), then feed it a JavaScript file that pulls down further tools, steals data, or opens a back door for the attackers.
The failure mode here is depressingly familiar. Security products are tuned to spot unknown or unsigned programs. Node.js is neither. It is the software equivalent of a courier in a high-vis vest walking through reception. Nobody stops him.
Why is this hard to catch?
Because almost nothing about the activity looks wrong on paper. A signed Microsoft-partner runtime executes a text file. That happens thousands of times a day inside any tech company.
The malicious behaviour only becomes obvious if you look at what the script is doing: contacting strange servers, reading browser password stores, or copying files it has no business touching. That kind of monitoring, usually called endpoint detection and response, or EDR (software that watches program behaviour rather than just filenames), is patchy outside larger organisations.
JavaScript also makes life easy for the attacker. It is text. It can be rewritten, obfuscated, or generated fresh for every victim, so simple signature-based antivirus struggles.
Who has been hit?
| Sector | Type of target | Active since |
|---|---|---|
| Government | Departments and agencies | February 2026 |
| Technology | Software and services firms | February 2026 |
| Hospitality | Hotel chains | February 2026 |
Symantec has not named individual victims, and the researchers have not tied the activity to a single named group. The shared thread is the tool, not the crew.
Should ordinary people worry?
Not directly, but the knock-on effects matter. If a hotel chain's booking system is broken into this way, guest details, including names, addresses and card data, can end up for sale. If a government department is hit, benefits or tax records could be exposed.
If you have stayed in a hotel or dealt with an agency that later announces a breach, treat unexpected emails and texts about your booking or account with suspicion. Do not click links in them. Go to the site directly.
Operational takeaway: if your EDR is not alerting on node.exe running out of a user's Downloads folder, it is not really watching node.exe at all.
