Mysterious Node.js malware puzzles security researchers

The malware was first spotted in February 2021, being installed as a second-stage payload via GCleaner, a shady software maker that has been seen renting access to users’ devices to malware groups.