NETSKOPE Threat Labs has documented a major upgrade to the Python NodeStealer infostealer, which has evolved into a full spyware platform as of August 2026. The Facebook-focused malware now collects keystrokes, monitors the clipboard and takes screenshots, and it builds a detailed dossier on the person managing each Facebook account. The campaign is aimed at users in Asia and North America, with financial services highlighted as a target sector.
Historically delivered via fake Facebook messages and malicious attachments, the latest variant continues to exfiltrate data via two distinct Telegram bots, allegedly splitting payloads into separate data streams for resilience and scope.
The upgraded node stealer adds three surveillance tools: a keylogger using the pynput library, a clipboard monitor via pyperclip, and a runtime screenshot module, alongside theft of Wi‑Fi passwords and data from several browsers beyond the original scope. The malware is observed to ship as compiled Python bytecode with a nulled .pyc header to obscure timestamps and file sizes, potentially hindering automated analysis.
Facebook profiling now queries more than 20 Graph API endpoints, expanding from two in earlier versions to harvest identity, social graph, account security, and commerce data, enabling cross-platform takeovers and higher-value resale. Exfiltration employs a split Telegram C2 design: one bot dumps a ZIP of browser credentials, passwords and cookies, the other handles Facebook-specific data, increasing resilience if one channel is compromised.
Researchers note potential AI-assisted code signatures, such as decorative emojis in logs, though attribution remains unproven. Detect and defend by inspecting Python bytecode, monitoring for keystroke, clipboard, and screenshot activity, and enforcing strong MFA and least-privilege controls for Facebook admins.