Python NodeStealer Adds Spyware Features and Expands Facebook Data Theft
Summary
Netskope found a Python NodeStealer variant with keylogging, clipboard monitoring, screenshots, expanded credential theft, and two Telegram C2 bots. It queries more than 20 Facebook Graph API endpoints; researchers suspect some additions were AI-assisted.
Key points
- The variant logs keystrokes, monitors copied plain text, and captures screenshots, sending the collected data to Telegram C2.
- It expands theft to Wi-Fi passwords, the victim’s Pictures folder, and two additional browsers.
- It queries more than 20 Facebook Graph API endpoints to collect identity, social, account-security, advertising, and commerce data.
- Two Telegram bots separate Facebook data from archives of stolen browser credentials, passwords, and cookie databases.
- The analyzed .pyc sample uses a CPython 3.12+ magic number but has nulled timestamp and source-size fields, which may hinder analysis.
- Netskope researchers suspect AI assistance based on emoji-labeled, repetitive code patterns; they advise defenders to inspect Python bytecode regardless of header metadata.
Article Details
- Attack Vectors
- Python NodeStealer steals browser credentials, passwords, cookies, Wi-Fi passwords, and files from the victim’s Pictures folder.
- The malware logs keystrokes, monitors clipboard text, and captures screenshots, then sends the collected data to Telegram bot C2 channels.
- The malware queries more than 20 Facebook Graph API endpoints to collect information about account holders, their social connections, account security, and commerce activity.
- Defensive Notes
- Ensure inspection tools analyze Python bytecode regardless of header metadata; the reported .pyc variant has nulled timestamp and source-file-size fields.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe malware sends stolen credentials, cookies, keystrokes, clipboard contents, screenshots, and Facebook data through its Telegram C2 channels.T1056.001 · KeyloggingPython NodeStealer records keyboard presses, including passwords and other sensitive input.T1113 · Screen CaptureThe malware captures screenshots of the victim’s monitor and sends them to a Telegram C2 channel.T1115 · Clipboard DataThe malware logs plain text copied to the clipboard and sends it to a Telegram C2 channel.
Malware
Products
FacebookSince 2023, Netskope Threat Labs has been tracking the Python-based NodeStealer, an infostealer targeting sensitive browser data and Facebook user, and Ads Manager accounts.Facebook Ads ManagerA year later, we observed that it had expanded the data it targets, looking for Facebook Ads Manager accounts and credit card information.