SecuriTricks - node.js

Yet Another NodeJS Backdoor (YaNB): A Modern Challenge

A resurgence in malicious campaigns exploiting deceptive CAPTCHA verifications has been observed, tricking users into executing NodeJS-based backdoors and deploying sophisticated Remote Access Trojans. The attack begins with a malicious NodeJS script connecting to attacker-controlled infrastructure…

backdoor

rat

system reconnaissance

Published: May 16, 2025

Downloadable IOCs: 11

Threat actors misuse Node.js to deliver malware and other malicious payloads

Since October 2024, threat actors have been leveraging Node.js to deliver malware and payloads for information theft and data exfiltration. A recent malvertising campaign uses cryptocurrency trading themes to lure users into downloading malicious installers. The attack chain includes initial access…

Published: April 15, 2025

Downloadable IOCs: 0

Malicious Packages Identified in the Wild: Insights and Trends from November 2024 Onward

FortiGuard Labs has analyzed malicious software packages detected from November 2024 to March 2025, revealing various attack techniques used to exploit system vulnerabilities. Key findings include 1,082 packages with low file counts, 1,052 packages with suspicious install scripts, and 1,043 package…

vulnerability exploitation

2025-03-10

install scripts

software packages

Published: March 10, 2025

Downloadable IOCs: 11

NodeLoader Exposed: The Node.js Malware Evading Detection

Zscaler ThreatLabz discovered a malware campaign using Node.js applications for Windows to distribute cryptocurrency miners and information stealers. Named NodeLoader, this malware family employs Node.js compiled executables to deliver second-stage payloads like XMRig, Lumma, and Phemedrone Stealer…

cryptocurrency miners

nodeloader

Published: December 13, 2024

Downloadable IOCs: 0

Distribution of Infostealer Made With Electron

AhnLab Security Intelligence Center (ASEC) has discovered an Infostealer malware strain developed using the Electron framework, which allows the creation of applications using JavaScript, HTML, and CSS. The malware is distributed through Nullsoft Scriptable Install System (NSIS) installer format. O…

Published: April 30, 2024

Downloadable IOCs: 1

Tag: node.js

Attack reports

Yet Another NodeJS Backdoor (YaNB): A Modern Challenge

Threat actors misuse Node.js to deliver malware and other malicious payloads

Malicious Packages Identified in the Wild: Insights and Trends from November 2024 Onward

NodeLoader Exposed: The Node.js Malware Evading Detection

Distribution of Infostealer Made With Electron