A major upgrade to the Python-based NodeStealer malware, transforming the Facebook-focused infostealer into a broader spyware platform capable of logging keystrokes, monitoring clipboard data, capturing screenshots, and harvesting extensive Facebook profile information.
The newly observed variant, identified in August 2026, also expands browser and local data theft, using a split Telegram command-and-control (C2) design to separate general credential theft from Facebook-specific exfiltration.
NodeStealer first emerged as a JavaScript-based threat linked to Facebook account theft.
In 2023, researchers observed a Python version that expanded the malware’s reach beyond Facebook by collecting browser credentials and session cookies from Chrome, Edge, Brave, Opera, Firefox, and other browsers.
Earlier delivery activity used bogus Facebook messages and malicious attachments designed to lure business-page administrators.
The latest version adds persistent surveillance functions. It uses the pynput Python library to record victim keystrokes, storing them in a temporary file named keylog({ip}).txt.
A background thread transmits the file to the attackers’ primary Telegram bot every 120 seconds before clearing its contents.
Because the logging process continues indefinitely, NodeStealer can capture passwords, messages, payment information, and other data entered through the keyboard.
Clipboard surveillance broadens that collection. The malware uses pyperclip to record copied plain text and sends it with the victim’s public IP address, allowing operators to associate captured data with a specific compromised device.
It also leverages pyautogui to take screenshots when the malware starts and again before its collection function finishes, potentially exposing active sessions, financial dashboards, private chats, and one-time authentication prompts.
The most consequential change is NodeStealer’s pivot from targeting Facebook accounts to profiling the individuals who manage them.
Previous variants queried only two Facebook Graph API endpoints, primarily to gather business and advertising-account details.
The new version invokes more than 20 endpoints spanning identity, social connections, content, page roles, advertising activity, commerce information, integrations, login data, and account-security signals.
Netskope Researchers said the campaign, primarily targeted organizations in Asia and North America, with financial services among the most affected sectors.
NodeStealer Spyware Malware
The malware attempts to collect personal details including a victim’s name, email address, birthday, gender, education, work history, location, profile image, friends, followed accounts, likes, groups, posts, events, videos, and linked business assets.
It also seeks Facebook Pages data, ad campaign details, ad account spending limits, total spend, account status, currency, business country code, products, orders, integrations, and login-related information.
That richer dataset can materially increase the value of a compromise.
Threat actors could use it to tailor business-email compromise lures, impersonate executives or brand administrators, identify high-value advertising accounts, or conduct account-takeover attempts across services where users reuse credentials or recovery information.
NodeStealer had already evolved in 2024 to target Facebook Ads Manager data and browser-stored credit-card information.
Researchers found it could use stolen Facebook cookies to obtain an access token and query Graph API data associated with businesses and ad accounts. The new release substantially extends that intelligence-gathering model.
Unlike older NodeStealer samples that relied on a single Telegram bot, the latest variant contains two bot tokens.
The primary bot receives a ZIP archive containing browser passwords, credentials, and cookie databases, while a second bot handles Facebook-specific information.
This separation may enable operational specialization and improve resilience if one bot is discovered or disabled.
Researchers also identified a compiled .pyc build using a CPython 3.12+ magic number.
Its timestamp and source-size header fields were set to zero, making the apparent compilation time January 1, 1970 and potentially complicating automated analysis workflows that rely on normal bytecode metadata.
Netskope said portions of the newly added code show characteristics consistent with AI-assisted development.
A method named save_additional_info queries the expanded Graph API endpoint list through repetitive, uniformly structured calls accompanied by decorative emoji labels.
Those emojis were absent from older NodeStealer code, suggesting the spyware additions may have been created or accelerated with large-language-model assistance.
Defenders should monitor for suspicious Python execution, Telegram Bot API traffic, unexpected access to browser SQLite databases, clipboard-monitoring libraries, screenshot tooling, and .pyc files with inconsistent or nulled header metadata.
Organizations should also strengthen protection for Facebook Business and Ads Manager administrators through phishing-resistant MFA, least-privilege access, session monitoring, and restrictions on untrusted attachments received through social platforms.
★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
