NodeStealer has returned with a more invasive toolkit. The Python-based information stealer can now record keystrokes, watch copied text, and capture victims’ screens, turning an account-stealing infection into continuous surveillance.
The change raises the stakes for people whose browsers hold work, banking, or social-media access. First tracked in 2023, NodeStealer initially focused on sensitive browser data and Facebook accounts.
It later widened its interest to Facebook Ads Manager accounts and payment-card information. The latest activity mainly affected victims in Asia and North America, with financial services the leading sector, but the campaign crossed several industries.
Netskope researchers identified the upgraded variant in August 2026 and said it adds spyware functions alongside the earlier theft features.
Netskope said in a report shared with Cyber Security News (CSN) that the researchers also found signs that some new code may have been produced with AI assistance.
The report does not identify a confirmed initial delivery method, so organizations should avoid assuming a single infection route.
What is clear is the malware’s objective after execution: collect enough credentials, session data, personal details, and screen content to support fraud, impersonation, or follow-on account takeover.
NodeStealer Can Now Record Everything Victims Type
The most worrying addition is a keylogger that uses Python’s pynput library to monitor keyboard input.
It saves captured text in a temporary file, sends it to the primary Telegram command-and-control channel every 120 seconds, and then clears the file’s contents. The logging is designed to continue indefinitely.
That can expose passwords, search terms, customer data, private messages, and other information that users enter manually. Clipboard monitoring fills a similar gap by collecting plain text copied and pasted into the device.
Readers following Snake Keylogger’s capture techniques will recognize how this combination gives criminals visibility beyond saved browser credentials.
NodeStealer also takes a screenshot when it runs and another before its screenshot function finishes, transmitting both images through Telegram.
A screen capture can reveal data that may never reach the clipboard or keyboard, including dashboards, recovery codes, open documents, and active conversations.
The separation of stolen material across two Telegram bots may also make disruption harder. One bot receives an archive of browser credentials, passwords, and cookie databases, while the other receives Facebook-specific data.
This approach resembles other Telegram bot driven malware operations that abuse legitimate messaging infrastructure for attacker communications.
Facebook Data Theft Expands
The newest samples query more than 20 Facebook Graph API endpoints, up from two in previous versions.
Rather than only checking an account, the malware seeks a detailed picture of the person managing it, covering identity details, contacts, interests, posts, pages, advertising assets, business records, integrations, and login-related data. For companies that run advertising campaigns, the impact can extend beyond one employee’s profile.
Access to business and Ads Manager information could help attackers run unauthorized ads, steal budgets, target colleagues, or make convincing social-engineering approaches. The risk mirrors Facebook advertising account theft reported in other malware campaigns.
Analysts noted an apparent AI-assisted element in the new functions: repeated, similarly structured calls marked with decorative emoji labels, a pattern absent from earlier NodeStealer code.
That observation is not proof of a particular tool or author, but it suggests attackers may be accelerating routine feature development.
The malware is also distributed as compiled Python bytecode with altered header fields, apparently intended to obscure its compilation timeline and possibly interfere with automated analysis.
Security teams should ensure that inspection workflows examine Python bytecode even when its metadata looks incomplete or misleading.
Defenders should treat unusual Python-based files, unexpected browser-data access, persistent keystroke collection, and Telegram-bound archives as high-priority signals.
Reduce exposure by limiting administrator access, keeping browsers and endpoint protections updated, reviewing active sessions, and warning staff not to run untrusted attachments or downloads. Recent phishing-delivered VIP Keylogger campaigns show why these basics still matter.
People responsible for Facebook business accounts should use strong multi-factor authentication, review connected apps, and watch for unfamiliar advertising changes.
Since cookies and session data can be valuable to attackers, prompt session revocation and credential resets are important after a suspected infection.
These steps cannot undo stolen screenshots, but they can limit further account abuse and reduce the chance of costly misuse.
Indicators of compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| File name pattern | keylog({ip}).txt |
Temporary keystroke-log filename pattern used by the NodeStealer keylogger, with the victim IP value inserted into the name. |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
The post NodeStealer Can Now Record Everything Victims Type and Steal Their Screenshots appeared first on Cyber Security News.