Attackers Exploit Trusted Node.js Runtime for Malware Delivery in Targeted Attacks

Threat actors are increasingly leveraging the legitimate Node.js JavaScript runtime as a malware delivery tool in targeted cyberattacks, according to a new report by the Symantec Threat Hunter Team. This technique has been observed in attacks against government departments, technology companies, and hotels since February 2026, allowing malicious payloads to bypass signature-based detection due to the trusted nature of the `node.exe` binary.