Ad

Node.js Malware Campaign Exploits Fake Binance & TradingView Installers to Target Crypto Users


A dangerous Node.js malware campaign is actively targeting cryptocurrency users through deceptive installers disguised as popular platforms like Binance and TradingView, according to a warning issued by Microsoft.


🚨 How the Node.js Malware Attack Works

First observed in October 2024, this ongoing malvertising campaign uses fraudulent websites to distribute fake cryptocurrency trading applications. The installers are embedded with a malicious DLL file named CustomActions.dll that:


  • Harvests system details via Windows Management Instrumentation (WMI)

  • Establishes persistence through Windows Scheduled Tasks

  • Launches a legitimate-looking browser using msedge_proxy.exe to display official trading websites, maintaining the illusion of authenticity


🔍 Stealth Tactics to Evade Detection

The malware uses PowerShell to download additional scripts from a remote command-and-control (C2) server. These scripts:


  • Add Microsoft Defender exclusions for the current PowerShell process and directory

  • Run obfuscated PowerShell commands to collect extensive OS, BIOS, hardware, and software data

  • Encode the stolen data in JSON format and exfiltrate it via HTTPS POST requests



    🛠 Node.js Used to Execute Malicious Scripts

    In the next stage, the malware downloads a Node.js runtime binary along with a JavaScript Compiled (JSC) file from the C2 server. The Node.js binary executes the malicious script, which initiates network communications, likely targeting sensitive browser data and credentials.


    🧪 Alternate Attack Chain: ClickFix Strategy

    An alternate infection path involves the ClickFix technique, where the attackers:

    • Use inline JavaScript execution via malicious PowerShell

    • Deploy Node.js directly to run code without file-based scripts

    • Conduct network discovery and disguise traffic as legitimate Cloudflare activity

    • Modify Windows Registry run keys to maintain persistence

     

    “Node.js is a trusted, open-source JavaScript runtime, but cybercriminals are exploiting it to camouflage malware, bypass security solutions, and embed within legitimate-looking applications,” Microsoft explained.

     


    🧊 Related: Fake PDF Converter Site Spreads SectopRAT Malware

    In a separate but related campaign, CloudSEK researchers uncovered a malicious site mimicking PDF Candy (candyxpdf[.]com, candyconverterpdf[.]com). Using the ClickFix trick, users were tricked into executing encoded PowerShell commands that deploy SectopRAT (ArechClient2)—a notorious info-stealing malware capable of:


    • Hijacking sensitive browser and system data

    • Maintaining persistent access on compromised machines

     

    “Threat actors cloned the user interface of the original PDF Candy and registered lookalike domains to mislead users,” said Varun Ajmera of CloudSEK.


    🧑‍💼 HR-Themed Phishing Scams by 'Payroll Pirates'

    Meanwhile, cybercriminals known as the Payroll Pirates have been running HR-themed phishing campaigns, leveraging:


    • Fake payroll portals

    • Sponsored search ads

    • Spoofed login pages


    Their goal? To steal employee login credentials and 2FA codes, rerouting payroll funds to attacker-controlled bank accounts.


    🔐 Final Thoughts: Stay Protected

    This wave of attacks shows how malware developers are becoming increasingly creative, using Node.js, PowerShell, and social engineering to bypass traditional defenses.


    Cyber hygiene tips:

    • Download software only from official websites

    • Beware of sponsored search results and unfamiliar URLs

    • Regularly update your endpoint protection tools

    • Monitor system activity for suspicious PowerShell or registry changes

    You May Like