Kiran 
A dramatically upgraded version of Python NodeStealer, a Facebook-focused infostealer active since 2023, that now behaves less like a credential thief and more like a full surveillance tool.
The August 2026 variant adds keystroke logging, clipboard monitoring, screenshot capture, and a split Telegram command-and-control setup, and researchers believe parts of the new code were written with help from an AI coding assistant.
NodeStealer first appeared targeting Facebook logins and browser-stored data, later expanding to Ads Manager accounts and payment card details.
Python NodeStealer Adds AI-Written Spyware Features
The newest samples go further, adding a persistent keylogger built on the pynput library that writes captured keystrokes to a local text file and exfiltrates it to a Telegram bot every 120 seconds, indefinitely.
A clipboard monitor using pyperclip captures copied text, and a screenshot module built on pyautogui grabs images of the victim’s screen at both the start and end of execution.
The malware also now harvests saved Wi-Fi passwords, the victim’s Pictures folder, and data from two additional browsers beyond its original targets.
Where earlier versions queried just two Facebook Graph API endpoints for basic account data, this variant calls more than 20 endpoints spanning identity, social graph, account security, and commerce information everything from friends lists and group memberships to ad account spend and business manager order histories.
The shift suggests attackers are no longer satisfied with hijacking an ad account; they’re building a detailed dossier on the human behind it, useful for cross-platform account takeover, impersonation scams, and reselling enriched victim profiles to other criminals.
Instead of funneling everything through a single Telegram channel, the malware now splits exfiltration across two bot tokens: one that receives the bulk ZIP containing stolen browser credentials, cookies, and passwords, and a separate one dedicated solely to harvested Facebook data.
Netskope analysts say this likely serves two purposes: separating data streams for distinct buyers and providing redundancy if one bot token is flagged and disabled.
The tell-tale clue pointing to AI involvement is stylistic rather than functional. A new method called save_additional_infoWhich enumerates all 20-plus Graph API calls uses decorative emojis to label each function, a formatting habit never seen in any prior NodeStealer sample.
Researchers suspect this pattern reflects output from a broad prompt, such as “collect all available Facebook data,” fed to a large language model, with the emoji-heavy structure carrying over into the final malware.
A compiled variant distributed as a .pyc file carries a valid CPython 3.12+ bytecode signature but has its timestamp and source-size header fields zeroed out, resetting the apparent compile date to January 1, 1970.
Netskope believes this is a deliberate attempt to skew researchers’ timeline analysis and disrupt automated decompilation tools, underscoring why defenders should scrutinize Python bytecode regardless of its metadata.
The campaign has primarily targeted victims across Asia and North America, with the financial services sector bearing the brunt, according to Netskope’s findings.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
