Threat actors misuse Node.js to deliver malware and other malicious payloads

Since October 2024 Microsoft Defender observed active malvertising campaigns using Node.js to deliver compiled JavaScript payloads and inline scripts that enable persistence, defense evasion, detailed system/browser data collection, and exfiltration to C2 servers; the report details the attack chain (malicious installers with a DLL, scheduled tasks running obfuscated PowerShell to download node.exe and .jsc files), IOCs, MITRE ATT&CK mappings, hunting queries for Defender XDR and Sentinel, and recommended mitigations.