Hackers Are Hiding Malware Inside Node.js, and Windows Sees Nothing Wrong

Key points

• Symantec's Threat Hunter Team says attackers have been abusing Node.js, a legitimate programming tool from the OpenJS Foundation, to run malware since February 2026.
• The technique works because node.exe is digitally signed and trusted by Windows, so security tools rarely flag it.
• Victims include government departments, technology companies and hotel chains.
• The malicious code is written in JavaScript, which makes it easy to hide and to rewrite between victims.
• Defenders are being told to watch for node.exe running in odd places, such as user folders or temporary directories.

Attackers have found a comfortable new hiding place, and it's one almost every IT team already trusts.

Symantec's Threat Hunter Team, part of Broadcom, says criminals have been quietly using Node.js to deliver malware since February 2026. Node.js is widely used software from the OpenJS Foundation that lets developers run JavaScript, the language behind most modern websites, directly on a server or laptop. Millions of machines carry it. Windows almost never questions it.

That's the whole point of the attack.

What are the hackers actually doing?

They're using a legitimate program, node.exe, to run malicious JavaScript. Because node.exe is signed and expected on developer and server machines, antivirus tools tend to leave it alone. The attacker pairs it with a script they control, and the script does the damage.

The Hacker News first covered the Symantec report, which describes campaigns aimed at government departments, technology firms and hotel groups. Infection methods vary across victims, but the pattern holds: get node.exe onto the machine (or use the copy already there), then feed it a JavaScript file that pulls down further tools, harvests credentials, or opens a back door.

The failure mode here is depressingly familiar. Security products are tuned to spot unknown or unsigned programs. Node.js is neither. It's the software equivalent of a courier in a high-vis vest walking through reception unchallenged.

We've tracked this living-off-the-land pattern closely: our 1 September story on phishing crews hijacking Faronics Deploy showed the same logic applied to a remote-management tool.

Why is this hard to catch?

Almost nothing about the activity looks wrong on paper. A signed, partner-trusted runtime executes a text file. That happens thousands of times a day inside any tech company.

Malicious behaviour only becomes obvious if you watch what the script does: contacting strange servers, reading browser password stores, copying files it has no business touching. That kind of monitoring, usually called endpoint detection and response, or EDR (software that watches program behaviour rather than just filenames), is patchy outside larger organisations.

JavaScript is text. It can be obfuscated or rewritten fresh for every victim, so signature-based antivirus struggles to keep pace.

Who has been hit?

Symantec hasn't named individual victims, and the researchers haven't tied the activity to a single named group. The shared thread is the tool, not the crew.

Should ordinary people worry?

Not directly, but the knock-on effects are real. If a hotel chain's booking system is broken into, guest names and card data can end up for sale. If a government department is hit, tax or benefits records could be exposed.

If you've stayed in a hotel or dealt with an agency that later announces a breach, treat unexpected emails about your booking with suspicion. Don't click links in them. Go to the site directly.

Operational takeaway: if your EDR isn't alerting on node.exe running out of a user's Downloads folder, it's not really watching node.exe at all.