- The Mess: NodeStealer has evolved from a Facebook-focused infostealer into a spyware platform that can log keystrokes, monitor clipboard contents, capture screenshots and build detailed profiles of Facebook users.
Netskope Threat Labs identified the upgraded Python-based variant in August 2026.
NodeStealer has been around since 2023. Earlier versions focused heavily on browser credentials, session cookies and Facebook accounts. Later builds expanded into Facebook Ads Manager and payment-card data.
The latest version goes much further.
It wants to know what the victim types.
What they copy.
What they see.
What they have stored in their browser.
And what they do with their Facebook account.
That is no longer just credential theft.
It is surveillance.
- The Damage: A single infection can expose passwords, browser sessions, clipboard contents, screenshots, Wi-Fi credentials, local files and enough Facebook business data to support impersonation, fraud and further account takeover.
The Keylogger Never Really Leaves
The most obvious upgrade is the keylogger.
NodeStealer uses Python’s pynput library to monitor keyboard input and stores captured keystrokes in a temporary file using a pattern such as keylog({ip}).txt.
The malware periodically sends the collected data to its command-and-control infrastructure through Telegram.
Then it clears the file and keeps logging.
That means the attacker isn’t limited to passwords already saved in Chrome or another browser.
They can potentially capture credentials typed manually, private messages, customer information, search queries and anything else entered through the keyboard.
A password manager doesn’t magically solve this problem either.
If the attacker controls the endpoint, the malware can watch what happens around the password manager.
The Clipboard Is Also Compromised
NodeStealer also monitors the clipboard.
That sounds boring until you consider what people actually copy and paste.
Passwords.
API keys.
Wallet addresses.
One-time codes.
Documents.
Bank details.
Internal URLs.
Customer information.
The malware collects plain-text clipboard content and associates it with the compromised system, including the victim’s public IP address.
That gives the attacker another stream of information without needing access to browser databases.
Then It Takes Screenshots
NodeStealer can capture screenshots during execution.
The image may reveal information that never appears in browser credential stores or keyboard logs.
An open banking dashboard.
A corporate CRM.
A password-reset page.
An MFA prompt.
A private conversation.
A financial report.
A cryptocurrency wallet.
A screenshot is the attacker’s view of the victim’s desktop at exactly the moment they need it.
Netskope identified screenshot capture alongside keylogging and clipboard monitoring in the new variant.
Facebook Became a Reconnaissance Database
The biggest change isn’t actually the keylogger.
It is what NodeStealer now does with Facebook.
Earlier versions queried only a small number of Facebook Graph API endpoints.
The new variant queries more than 20.
The malware attempts to collect information covering identity, social connections, posts, pages, advertising activity, commerce information, integrations and account-security data.
That turns a stolen Facebook session into something much more valuable.
The attacker isn’t simply asking:
“Can I access this account?”
They are asking:
“Who owns this account?”
“What businesses does this person control?”
“How much money flows through their advertising accounts?”
“Who are their contacts?”
“What companies are connected to them?”
“Which accounts can be abused next?”
The malware is building a dossier.
Business Accounts Are the Real Prize
For an ordinary Facebook user, account theft is bad.
For someone managing advertising campaigns, company pages or business assets, it can become a financial attack.
Attackers can use stolen information to impersonate administrators, target employees, manipulate advertising infrastructure or construct much more convincing social-engineering messages.
Facebook Ads Manager data is particularly interesting because it can expose business relationships and financial activity.
NodeStealer previously expanded into this area.
The new version makes the reconnaissance significantly broader.
Two Telegram Bots Split the Loot
The new architecture also separates command-and-control functions.
One Telegram bot handles the general stolen data, including browser credentials, cookies and passwords.
A second bot handles Facebook-specific information.
That separation makes operational sense.
If one channel gets disrupted, the attackers don’t necessarily lose every function at once.
It also allows the stolen data to be handled differently depending on its value.
Telegram remains attractive to malware operators because it provides an easy communications layer without requiring them to maintain a conventional command server.
NodeStealer Now Looks Like Spyware
The evolution is worth looking at.
2023: steal browser credentials and Facebook sessions.
2024: expand into advertising accounts and payment-card information.
2026: add keylogging, clipboard surveillance, screenshots, Wi-Fi credentials and broader local-file collection.
The malware didn’t become more complicated just for the sake of it.
It became more useful.
A browser infostealer gives an attacker credentials.
A spyware platform gives them context.
Context is what makes the stolen credentials more valuable.
There Are Signs of AI-Assisted Development
Netskope researchers also noticed characteristics suggesting that some of the newly added code may have been produced with assistance from an LLM.
One of the clues is the systematic use of decorative emojis in logging and output structures that were not present in earlier NodeStealer versions.
That isn’t proof that an AI model wrote the malware.
It is an indicator.
But the broader trend matters.
Adding another API integration, another collector or another telemetry function is becoming cheaper.
Malware authors don’t necessarily need to hand-write every feature.
They can ask an AI coding assistant to generate routine code, adapt an existing collector or explain an API.
The result is not necessarily revolutionary malware.
It is something arguably more annoying:
malware that can evolve faster.
The Targeting Is Wider Than Facebook
Netskope observed victims primarily in Asia and North America across multiple sectors, with financial services leading the observed targeting.
That makes sense.
Financial employees have access to credentials, customer data, payment systems, trading platforms and business accounts.
A machine containing all of those sessions is a much better target than a random home PC.
And NodeStealer is designed to harvest exactly that type of information.
The Fix
Treat an infected endpoint as compromised, not merely as a machine with one stolen password.
Revoke active sessions.
Reset credentials from a clean device.
Rotate API keys and tokens.
Review Facebook and business-account sessions.
Check advertising activity.
Inspect browser extensions and stored credentials.
Hunt for unexpected Python executables, suspicious Telegram network traffic and files matching the malware’s keylogging patterns.
Endpoint detection should also watch for unusual access to browser databases, clipboard monitoring, screenshot APIs and credential stores.
- The Fix: If NodeStealer is suspected, isolate the endpoint, revoke active sessions, rotate credentials and tokens, review Facebook business and advertising accounts, and investigate the machine for persistence and additional malware before returning it to normal use.
Deleting the suspicious executable isn’t enough.
The attacker may already have the password.
They may already have the cookie.
They may already have the screenshot.
They may already know who your customers are.
Bugstoday Opinion
NodeStealer is a good example of how malware evolves without needing a spectacular zero-day.
It started as a browser thief.
Then it learned about advertising accounts.
Now it watches the victim type.
It watches the clipboard.
It takes pictures of the screen.
It inventories the victim’s digital life.
The interesting part isn’t that NodeStealer gained a keylogger.
Lots of malware has one.
The interesting part is the combination.
Credentials tell attackers what you can access.
Screenshots tell them what you are doing.
Keylogging tells them what you are typing.
Facebook reconnaissance tells them who you are connected to.
Put all four together and the infostealer stops looking like a password thief.
It starts looking like a remote surveillance employee who never sleeps.
And unlike an employee, it doesn’t ask for a salary.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
Netskope Threat Labs — Python NodeStealer: AI-Assisted to Full Spyware
Netskope Threat Labs — NodeStealer Research
Meta Security — NodeStealer Malware Analysis
Palo Alto Networks Unit 42 — NodeStealer 2.0 Research
