Node.js Signed Binary Deployed via ClickFix for EtherHiding and C2Looper in 2026 Government and Finance Intrusions

Symantec documented multiple intrusions where node.exe, a signed developer binary, executed attacker-controlled scripts after initial ClickFix social engineering access. In one March-to-July 2026 campaign against an Asian technology company, operators pivoted from blocked AdaptixC2 and Cobalt Strike attempts to deploy EtherHiding implants and ModeloRAT linked to the KongTuke initial access broker. Registry Run keys ensured relaunch at login while avoiding signature detection on interpreted code rather than binaries.

Technical evidence shows shared domains and command chains connecting these operations to Zscaler's documented C2Looper Rust backdoor deployment against a U.S. fintech organization beginning May 2026. GuidePoint Security separately recorded 31 compromised e-commerce and logistics entities using similar ClickFix vectors. The pattern reveals repeated abuse of trusted runtimes after commodity C2 tools were blocked, not isolated incidents.

This approach aligns with broader living-off-the-land tactics where dual-use tools like PowerShell and legitimate installers mask activity. Multiple actors, including those behind AsukaStealer and Mistic, have adopted Node.js because signature-based defenses ignore interpreted scripts. Official reports emphasize the technique's appeal but understate how procurement of signed binaries from official domains creates attribution gaps between technical indicators and claimed actor identities.

Enterprises must baseline Node.js deployments against job postings and procurement records rather than rely on endpoint signatures. Expect expanded monitoring of developer tool executions and registry modifications in the next quarter as detection shifts to behavioral anomalies.