Published on September 4, 2026
NodeStealer Spyware Expands to Keylogging, Screenshot Capture and Facebook Data Theft
Severity
Medium
A new variant of the Python-based NodeStealer malware has expanded beyond its previous focus on Facebook account theft, adding spyware capabilities such as keylogging, clipboard monitoring, screenshot capture, and extensive Facebook data collection.
The variant, identified in August 2026, also expands its ability to steal browser and local data while using a split Telegram-based command-and-control (C2) structure to separate general credential theft from Facebook-related information.
How?
NodeStealer was initially developed to target Facebook accounts before evolving into a broader information-stealing malware capable of collecting browser credentials and session cookies from multiple browsers, including Chrome, Edge, Brave, Opera, and Firefox.
The latest variant introduces persistent surveillance capabilities. It uses the Python pynput library to capture keystrokes and stores the collected data in a temporary file named keylog({ip}).txt. The file is periodically sent to the attackers’ primary Telegram bot every 120 seconds before its contents are cleared.
Because the keylogging continues while the malware is running, attackers can potentially capture passwords, messages, payment information, and other sensitive information entered through the keyboard.
NodeStealer also monitors clipboard activity using the pyperclip library. Captured plain-text clipboard data is sent to the attackers together with the victim’s public IP address, allowing the stolen information to be linked to a specific compromised system.
The malware uses the pyautogui library to capture screenshots when it starts and again before completing its data-collection process. These screenshots could expose active sessions, financial information, private conversations, and one-time authentication prompts displayed on the screen.
The latest version also significantly expands its Facebook data collection capabilities. While earlier variants primarily queried a small number of Facebook Graph API endpoints for business and advertising information, the new version accesses more than 20 endpoints covering identity information, social connections, posts, page roles, advertising activity, commerce data, integrations, login information, and account-security details.
The collected information can include the victim’s name, email address, birthday, gender, education, employment history, location, profile image, friends, followed accounts, likes, groups, posts, events, videos, and linked business assets.
The malware also collects information related to Facebook Pages, advertising campaigns, ad-account spending limits and spending history, account status, currency, business information, products, orders, integrations, and login activity.
This expanded information could help attackers identify high-value accounts and develop more convincing follow-on attacks, including business email compromise (BEC), executive or brand impersonation, and account-takeover attempts.
The malware uses two Telegram bot tokens in the latest version. The primary bot receives a ZIP archive containing browser passwords, credentials, and cookie databases, while the second bot is dedicated to Facebook-related information. Separating the stolen data between two bots may help the attackers organize their operations and maintain resilience if one bot is disrupted.
Researchers also identified a compiled .pyc version of the malware using a CPython 3.12+ magic number. Its timestamp and source-size metadata were set to zero, resulting in an apparent compilation date of January 1, 1970 and potentially complicating automated analysis based on normal Python bytecode metadata.
Researchers noted that portions of the newly added code show characteristics associated with AI-assisted development. One example is the save_additional_info method, which repeatedly queries the expanded Facebook Graph API endpoint list using a consistent structure and decorative emoji labels that were not present in older versions.
Conclusion
The latest NodeStealer variant demonstrates how the malware has evolved from a Facebook-focused information stealer into a broader surveillance and intelligence-gathering tool capable of collecting credentials, browser data, screenshots, clipboard contents, and extensive information from Facebook accounts.
Source