Do Son 
Netskope Threat Labs found a major upgrade to the Python NodeStealer malware in August 2026. The Facebook-focused infostealer now works as full spyware. It logs keystrokes, watches the clipboard, and grabs screenshots. This Python NodeStealer variant also builds a deep dossier on the person managing each Facebook account.
At a glance
| Malware family | Python NodeStealer (infostealer to spyware) |
| Threat actor | Not attributed; new code suspected AI-assisted |
| Targets | Asia and North America; led by financial services |
| Delivery vector | Historically fake Facebook messages and malicious attachments |
| Key capabilities | Keylogging, clipboard and screen capture, browser and Facebook theft |
| Source | Netskope Threat Labs |
TL;DR
NodeStealer has grown from a basic Facebook Ads stealer into a spyware platform. The new variant records keystrokes, clipboard text, and screenshots. It then exfiltrates the data through two separate Telegram bots.
Why this matters
NodeStealer once drained ad accounts for quick profit. Now it exposes victims at the identity level. As Netskope puts it, the latest variant “is a capable spyware platform.” It logs keystrokes indefinitely and captures the screen on execution. So a single infection can expose passwords, private files, and a full social profile.
Infection chain and new spyware features
The upgraded Python NodeStealer adds three surveillance tools. A keylogger uses the pynput library to record every keypress. A clipboard monitor captures pasted text through pyperclip. A screenshot module grabs the display at runtime. Beyond these, the malware now steals Wi-Fi passwords, the victim’s Pictures folder, and data from two more browsers.
Netskope also found a stealth trick in the file format. The sample ships as compiled Python bytecode with a nulled .pyc header. This zeroes the timestamp and file-size fields. The move may mislead researchers and disrupt automated decompilation.
Facebook profiling goes deep
Earlier versions queried just two Facebook Graph API endpoints. The new variant queries more than 20. Together, they cover identity, social graph, account security, and commerce data. As a result, attackers build a dossier on the user, not just the account. That data enables cross-platform account takeover, impersonation scams, and higher-value resale.
Command-and-control and exfiltration
The malware uses a split Telegram C2 design. Previous variants relied on a single bot. This version uses two distinct bot tokens for separate jobs. One bot receives a ZIP archive of stolen browser credentials, passwords, and cookies. The other receives only the Facebook-specific data.
Netskope suggests two reasons for the split. First, it separates data streams into distinct pipelines. Second, it adds resilience. If one bot token is burned, the other keeps working.
The AI-assisted angle
Netskope suspects parts of the new code were written with AI help. The clearest tell is the systematic use of decorative emojis in the output logs. Earlier NodeStealer samples never used them. One new method also enumerates 20-plus Graph API endpoints in a single, uniform block. This is confirmed as a suspicion, not proven attribution.
Detection and defense guidance
Inspect Python bytecode regardless of header metadata, since the .pyc fields can be faked. Watch for unexpected access to browser credential databases. Flag persistent keystroke collection and Telegram Bot API traffic. Also monitor for clipboard-monitoring and screenshot libraries on endpoints.
Facebook Business and Ads Manager admins need extra care. Enforce phishing-resistant MFA and least-privilege roles. Limit untrusted attachments arriving through social platforms. These steps blunt both the theft and the follow-on account takeovers.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
