Attackers Abuse Node.js and Blockchain Contracts to Run Persistent Malware

Multiple threat actors have revived abuse of the legitimate, signed Node.js runtime to execute malicious JavaScript implants, establish persistence, and bypass signature-based controls. Intrusions at an Asian technology company and a U.S. fintech organization reportedly began with ClickFix lures and PowerShell downloaders, followed by AdaptixC2, Cobalt Strike, and, in the U.S. case, the Rust-based C2Looper backdoor. After payloads were blocked at the Asian victim, operators installed Node.js from nodejs.org, created a Registry Run-key persistence mechanism, and queried Ethereum RPC gateways for command-and-control instructions—activity consistent with EtherHiding. Related campaigns have targeted government entities, hotels, and technology organizations using malware including ModeloRAT, Backdoor.Mistic, EtherRAT, and a Node.js variant of AsukaStealer.

A separate EtherHiding-enabled ClickFix campaign allegedly compromised at least 31 legitimate business websites and used fake CAPTCHA prompts to convince visitors to run malicious commands. Its persistent backdoor retrieved mutable C2 configuration from Polygon smart contracts, making conventional IP- and domain-based blocking less durable; reported capabilities also included Registry and scheduled-task persistence, host fingerprinting, and browser-extension or web-inject activity that could expose banking and cryptocurrency credentials. Organizations should prioritize detection of unauthorized Node.js installations and suspicious JavaScript execution, restrict browser extensions, audit web properties for injected ClickFix content, and monitor blockchain RPC access and behavior-based indicators rather than relying solely on static infrastructure blocks.