{"id":58493,"date":"2025-04-15T17:00:00","date_gmt":"2025-04-15T17:00:00","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/threat-actors-misuse-node-js-to-deliver-malware-and-other-malicious-payloads\/"},"modified":"2025-04-15T17:00:00","modified_gmt":"2025-04-15T17:00:00","slug":"threat-actors-misuse-node-js-to-deliver-malware-and-other-malicious-payloads","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/threat-actors-misuse-node-js-to-deliver-malware-and-other-malicious-payloads\/","title":{"rendered":"Threat actors misuse Node.js to deliver malware and other malicious payloads"},"content":{"rendered":"

Since October 2024, Microsoft Defender Experts (DEX) has observed and helped multiple customers address campaigns leveraging Node.js to deliver malware and other payloads that ultimately lead to information theft and data exfiltration. While traditional scripting languages like Python, PHP, and AutoIT remain widely used in threats, threat actors are now leveraging compiled JavaScript\u2014or even running the scripts directly in the command line using Node.js\u2014to facilitate malicious activity. This shift in threat actor techniques, tactics, and procedures (TTPs) might indicate that while Node.js-related malware aren\u2019t as prevalent, they\u2019re quickly becoming a part of the continuously evolving threat landscape.<\/p>\n

Node.js is an open-source, cross-platform JavaScript runtime environment that allows JavaScript code to run outside of a web browser. It\u2019s widely used and trusted by developers because it lets them build frontend and backend applications. However, threat actors are also leveraging these Node.js characteristics to try to blend malware with legitimate applications, bypass conventional security controls, and persist in target environments.  <\/p>\n

Among the most recent attacks we\u2019ve observed leveraging Node.js include a malvertising campaign related to cryptocurrency trading that attempts to lure users into downloading a malicious installer disguised as legitimate software. The said campaign is still active as of April 2025. This blog provides details of its attack chain, along with an example of the emerging inline script execution technique. This blog also includes recommendations to help users and defenders reduce the impact of these attacks in their environments.<\/p>\n

Malicious ads deliver compiled Node.js executables<\/h2>\n

Malvertising<\/a> has been one of the most prevalent techniques in Node.js attacks we\u2019ve observed in customer environments. Attackers use malvertising campaigns to lure targets to fraudulent websites, where the targets then unknowingly download a malicious installer disguised as legitimate software. These fake websites often take advantage of popular themes such as financial services, software updates, and trending applications.<\/p>\n

In this campaign, the downloaded installer contains a malicious DLL that gathers system information and sets up a scheduled task for persistence. This sets the stage for its other techniques and activities, such as defense evasion, data collection, and payload delivery and execution.<\/p>\n

\"Diagram
Figure 1. Overview of the malvertising campaign leveraging Node.js<\/em><\/figcaption><\/figure>\n

Initial access and persistence<\/h3>\n

This campaign uses malicious ads with a cryptocurrency trading theme to lure the target user into visiting a website and downloading a malicious installer disguised as a legitimate file from cryptocurrency-trading platforms like Binance or TradingView. This installer is a Wix-built package containing a malicious CustomActions.dll<\/em>. When launched, the installer loads the DLL, which then gathers basic system information through a Windows Management Instrumentation (WMI) query and creates a scheduled task to ensure persistence of a PowerShell command. Simultaneously, the DLL launches a decoy by opening an msedge_proxy<\/em> window that displays a legitimate cryptocurrency trading website.<\/p>\n

Defense evasion<\/h3>\n

The created scheduled task runs PowerShell commands designed to exclude both the PowerShell process and the current directory from being scanned by Microsoft Defender for Endpoint. This action prevents subsequent PowerShell executions from being flagged, allowing the attack to continue undisturbed.<\/p>\n

\"Screenshot
Figure 2. Command line used for the exclusions<\/em><\/figcaption><\/figure>\n

Data collection and exfiltration<\/h3>\n

With the exclusions set, an obfuscated PowerShell command is then launched through scheduled tasks to continuously fetch and run scripts from remote URLs. These scripts gather detailed system information, including:<\/p>\n