Netskope Threat Labs reports that Python-based NodeStealer has evolved from a Facebook credential stealer into a spyware-capable tool with keylogging, clipboard monitoring, screenshot capture, and a split Telegram C2 design. The new variant also expands Facebook Graph API collection to more than 20 endpoints, suggesting AI-assisted development and broader abuse of Facebook and Ads Manager data. #NodeStealer #NetskopeThreatLabs #Facebook #AdsManager #Telegram
Keypoints
- Python-based NodeStealer has been tracked since 2023 and originally targeted Facebook user data, browser credentials, and Ads Manager accounts.
- The latest variant adds spyware-like features, including keylogging, clipboard monitoring, and screenshot capture.
- It now steals additional data such as Wi-Fi passwords, the victim’s Pictures folder, and information from two more web browsers.
- NodeStealer now uses more than 20 Facebook Graph API endpoints to build a detailed profile of the victim managing the account, not just the account itself.
- The campaign uses a dual Telegram bot C2 architecture, separating browser credential theft from Facebook-specific data exfiltration.
- Netskope observed signs that the added code may have been AI-assisted, including unusually systematic emoji usage and repetitive method structure.
- The malware was mainly aimed at victims in Asia and North America, with the financial services sector among the most impacted.
MITRE Techniques
- [T1056.001 ] Keylogging – The malware records every keystroke, including passwords and other sensitive input, using the pynput library (‘monitor keyboard presses’, ‘keyboard logger persists indefinitely’).
- [T1115 ] Clipboard Data – It watches clipboard paste activity to collect sensitive text copied by the victim (‘monitor clipboard paste activity’, ‘Any plain text pasted to the clipboard is logged’).
- [T1113 ] Screen Capture – It captures screenshots of the victim’s monitor when executed and again before the function ends (‘captures a screenshot of the victim’s monitor’, ‘Both screenshots are sent to the Telegram C2 channel’).
- [T1105 ] Ingress Tool Transfer – Stolen data is packaged and sent to Telegram C2 channels for exfiltration (‘sending the text file to the main Telegram C2 channel’, ‘Both screenshots are sent to the Telegram C2 channel’).
- [T1027 ] Obfuscated Files or Information – The sample is distributed as a .pyc bytecode file and nulls out header fields to hinder analysis and mislead researchers (‘Nulling these fields may be an attempt to mislead researchers’, ‘modified header fields’).
Indicators of Compromise
- [File names] Keylogger output and packaged stolen data – keylog({ip}).txt, primary ZIP archive
- [File types] Compiled Python bytecode sample – .pyc, CPython 3.12+ bytecode
- [Tools/Libraries] Python libraries used in the malware – pynput, pyperclip, pyautogui
- [Infrastructure] Command-and-control platform used for exfiltration – Telegram bot tokens, main Telegram C2 channel, second Telegram bot
- [Platform/API targets] Data collection sources – Facebook Graph API, Facebook Ads Manager
Read more: https://www.netskope.com/blog/python-nodestealer-ai-assisted-to-full-spyware