Python NodeStealer Adds Spyware Features and Expands Facebook Data Theft
Summary
Netskope found a Python NodeStealer variant with keylogging, clipboard and screenshot capture, expanded Facebook Graph API collection, and separate Telegram bots for stolen browser credentials and Facebook data. AI assistance is suspected, not confirmed.
Key points
- The variant adds persistent keylogging, clipboard monitoring, and screenshot capture, using pynput, pyperclip, and pyautogui.
- It also targets Wi-Fi passwords, the victim’s Pictures folder, and data from two additional browsers.
- It queries more than 20 Facebook Graph API endpoints, expanding collection from account details to the identity, social graph, security, and commerce data of the person managing the account.
- Two Telegram bots separate browser-credential and related data from Facebook-specific data exfiltration.
- The analyzed sample is CPython 3.12+ bytecode with nulled timestamp and source-size fields, which Netskope says may mislead researchers or disrupt automated decompilation.
- Netskope reports signs consistent with AI-assisted code, including systematic emoji labels and repetitive method structure; this attribution is uncertain.
- The campaign mainly targeted victims in Asia and North America, with financial services the most impacted sector.
Article Details
- Attack Vectors
- Python-based NodeStealer is distributed as a compiled .pyc bytecode sample.
- The malware steals browser credentials, passwords, cookie databases, Wi-Fi passwords, and files from the victim's Pictures folder.
- It monitors keystrokes and clipboard contents and captures screenshots.
- It queries more than 20 Facebook Graph API endpoints to collect identity, social, account-security, advertising, and commerce data.
- Stolen data is sent to two separate Telegram bot C2 channels: one for browser credentials and related data, and another for Facebook-specific data.
- Defensive Notes
- Ensure inspection tools analyze Python bytecode even when header metadata has been modified.
- Monitor for suspicious Python processes using pynput, pyperclip, or pyautogui to capture input, clipboard contents, or screenshots.
- Monitor for unauthorized access to Facebook Graph API data and suspicious outbound transfers to Telegram.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe analyzed .pyc sample has its timestamp and source-size header fields nulled, which the article says may mislead researchers or disrupt automated decompilation.T1041 · Exfiltration Over C2 ChannelNodeStealer exfiltrates stolen browser credentials, keylogs, screenshots, and Facebook-specific data through Telegram bot C2 channels.T1056.001 · KeyloggingNodeStealer uses pynput to record keystrokes, including passwords, and periodically sends the resulting keylog file to its Telegram C2.T1113 · Screen CaptureNodeStealer uses pyautogui to capture screenshots at execution and before the screenshot function ends, then sends them to Telegram C2.T1115 · Clipboard DataNodeStealer uses pyperclip to log plain text copied to the clipboard and sends it to a Telegram C2 channel.
Malware
Products
FacebookNetskope Threat Labs reports that Python-based NodeStealer has evolved from a Facebook credential stealer into a spyware-capable tool with keylogging, clipboard monitoring, screenshot capture, and a split Telegram C2Facebook Ads ManagerThe new variant also expands Facebook Graph API collection to more than 20 endpoints, suggesting AI-assisted development and broader abuse of Facebook and Ads Manager data.Telegraminto a spyware-capable tool with keylogging, clipboard monitoring, screenshot capture, and a split Telegram C2 design.
Tools
pyautogui[Tools/Libraries] Python libraries used in the malware – pynput, pyperclip, pyautoguipynput[T1056.001 ] Keylogging – The malware records every keystroke, including passwords and other sensitive input, using the pynput library (‘monitor keyboard presses’, ‘keyboard logger persists indefinitely’).pyperclip[Tools/Libraries] Python libraries used in the malware – pynput, pyperclip, pyautogui