Interpreter abuse is a technique where attackers use a legitimate scripting engine or runtime, such as Node.js, PowerShell, Python, or Bash, to execute malicious code. Instead of dropping a clearly suspicious standalone malware binary, the attacker relies on software that is already trusted, installed, and often allowed to run on the target system.
This matters because security tools and analysts may give less scrutiny to known interpreters than to unknown executables. Malicious scripts can blend in with normal administration, development, or automation activity, while still downloading payloads, running commands, or establishing persistence. Defenders should watch process lineage, command-line arguments, child processes, and unexpected network or file activity. In practice, unusual launches of node.exe or other scripting hosts on systems that rarely use them can be an important clue that a trusted runtime is being repurposed as a delivery mechanism.