Node.js: Old Technique Makes a Comeback

**Executive summary:** Symantec observed a resurgence of Node.js abuse since February–July 2026 where attackers install legitimate Node.js runtimes to execute malicious JavaScript, maintain persistence via Run keys and services, and retrieve commands or payloads from Ethereum smart contracts (EtherHiding); campaigns involved AdaptixC2, Cobalt Strike, ModeloRAT, EtherRAT, Backdoor.Mistic and a Rust backdoor (C2Looper), affected multiple sectors (government, fintech, tech, hotels), and include extensive file and network IOCs for detection and mitigation.