Python NodeStealer Evolves via AI-Assisted Development into Full Spyware Targeting Facebook Business Accounts

Python NodeStealer Evolves via AI-Assisted Development into (TL-2026-2296), also tracked as NodeStealer, is a high-severity malware campaign, first published 2026-09-02. It is linked to a Vietnam-nexus actor with medium confidence, affects Meta Platforms Facebook Business and Ads Manager accounts, maps to 18 MITRE ATT&CK techniques (T1005, T1027, T1056.001), and is covered by 9 detection rules and 30 indicators of compromise.

Key facts for TL-2026-2296

Threat ID
TL-2026-2296
Also known as
NodeStealer
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-09-02
Last reviewed
2026-09-02
Attribution confidence
MEDIUM
Nation-state nexus
Vietnam
Motivation
FINANCIAL
Target sectors
financial services, manufacturing, technology
Target regions
Asia, North America, 039 - Southern Europe
Detection rules
9
Indicators of compromise
30

Malware and tooling in Python NodeStealer Evolves via AI-Assisted Development into

Malware and tooling: NodeStealer, Script-Python.Infostealer, Trojan.Generic.39958647, Trojan.Stealer.130, 5512231206, 6182684172, 7094444204:AAFoaWZVfCF4ZyHvMpuAY0U15D3JlzxhNYg, 7300493307, 7538597440:AAEsJistNXUaiM43icWerxRW1ZCROiqcx6Q, 8842354283:AAFklEDGu7yjXAZajQG4cOaggcYtVtmqnsc, pyautogui, pynput

Netskope Threat Labs documented a new Python NodeStealer variant (August 2026) that expands the long-running Facebook-credential-theft malware family into full spyware, adding keylogging, clipboard monitoring, screen capture, Wi-Fi password theft, and abuse of 20+ Facebook Graph API endpoints (up from 2). Code artifacts -- decorative emoji patterns hard-coded into log output -- point to LLM-assisted development of the new capabilities.

How Python NodeStealer Evolves via AI-Assisted Development into works

NodeStealer's origins predate the Python family Netskope has tracked since 2023: Palo Alto Networks Unit 42 traces the earliest JavaScript-based NodeStealer sample to a July 2022 compile date, with Meta identifying malicious activity beginning in January 2023 and publicly reporting on the JavaScript variant's Facebook business-account credential and cookie theft in May 2023. In parallel, Unit 42 documented a Python-compiled 'NodeStealer 2.0' campaign that it dates to approximately December 2022 and disclosed in an August 1, 2023 report: two Python variants that layered in MetaMask cryptocurrency-wallet theft, full Facebook account-takeover functionality, a downloader for staging additional malware, and -- in the second variant -- anti-analysis/anti-VM checks and webmail-reading capability, with account-takeover operations routed through the Vietnamese-oriented hotmailbox.me and dongvanfb.net mailbox services.

Python NodeStealer is a credential- and cookie-theft malware family that Netskope Threat Labs has tracked since September 2023, when it targeted Facebook business-account owners via Messenger lures carrying 'defective product' attachments hosted on Facebook's own CDN and on the attacker-controlled domain vuagame[.]store. That original variant stole Login Data, cookies, and 'Local State' encryption keys from Chrome, Microsoft Edge, Brave, Opera, Cốc Cốc, and Firefox, prioritizing Facebook session cookies, and persisted via a batch file dropped into the Windows Startup folder that repeatedly re-launched a Python script named project.py. Stolen data was staged locally, zipped, and exfiltrated over the Telegram Bot API alongside victim IP address, country, and hostname.

In November 2024, Netskope reported a second-generation variant that abused the legitimate Windows Restart Manager library (via windll.LoadLibrary and RmShutdown) to force-close browser processes and unlock database files that would otherwise block credential theft -- a LOLBin technique intended to evade behavioral detection. This variant padded its payload with tens of megabytes of junk code, wrapped the Python script inside batch files that echo it line-by-line into a separate file, added theft of stored credit-card data from the browsers' 'Web Data' SQLite database, and pivoted to hijacking Facebook Ads Manager accounts by generating access tokens from stolen cookies and querying the Graph API for ad account budgets, spend, currency, and country codes. Operators geofenced the malware to exit immediately if the victim's IP-derived country code resolved to Vietnam.

On August 25, 2026, Netskope Threat Labs disclosed a third-generation variant that crosses the malware from an infostealer into full spyware. The new build adds keystroke logging via the pynput library (output written to %TEMP%\\keylog({ip}).txt and transmitted to the attacker's Telegram channel roughly every 120 seconds), clipboard monitoring via pyperclip (captured plain-text clipboard content paired with the victim's IP address), screenshot capture via pyautogui taken at both the start and the completion of malware execution, extraction of saved Wi-Fi passwords, and exfiltration of the victim's Pictures folder. Facebook targeting deepened substantially: the malware now queries more than 20 Graph API endpoints (versus 2 in earlier variants), pulling identity data, the social graph (friends/following/likes), content (posts/groups/events/videos), Pages data, advertising data, commerce/business-manager data, and account-security/login data -- Netskope assesses this is intended to build comprehensive victim profiles that enable account takeovers, impersonation scams, and higher-value resale of the harvested data. Exfiltration now runs through a dual-Telegram-bot architecture -- one bot for general stolen data, a second dedicated to Facebook-specific data -- which Netskope assesses suggests operational specialization or channel redundancy. The compiled .pyc payloads (CPython 3.12+ bytecode) have their header timestamp and file-size fields nulled to the Unix epoch, intended to mislead researchers about the compilation timeline and disrupt automated decompilation pipelines. Netskope's evidence for AI-assisted development is the systematic, decorative use of emojis inside the save_additional_info method's log output -- a pattern consistent with LLM-generated code rather than hand-written operator tooling. Netskope Threat Protection flags the family as Script-Python.Infostealer, Trojan.Stealer.130, and Trojan.Generic.39958647. Across its documented history the campaign has primarily targeted victims in Asia and North America (with the 2024 variant also hitting Southern Europe), led by the financial services sector, with manufacturing and technology also affected. Independent reporting from 2023 (citing Meta's original findings) attributes the family to Vietnamese-linked threat actors, based on Vietnamese-language code artifacts, deliberate targeting of the Cốc Cốc browser popular in Vietnam, and the operators' own geofencing to exclude Vietnamese victims.

MITRE ATT&CK techniques used in TL-2026-2296

Collection

T1005 Data from Local System; T1056.001 Keylogging; T1113 Screen Capture; T1560 Archive Collected Data

Defense Evasion

T1027 Obfuscated Files or Information; T1070.006 Timestomp; T1497 Virtualization/Sandbox Evasion

Execution

T1059.003 Windows Command Shell; T1059.006 Python; T1204.002 Malicious File

Discovery

T1082 System Information Discovery; T1614 System Location Discovery

Credential Access

T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers

Persistence

T1547.001 Registry Run Keys / Startup Folder

Initial Access

T1566.003 Spearphishing via Service

Exfiltration

T1567.004 Exfiltration Over Webhook

Affected products and versions in Python NodeStealer Evolves via AI-Assisted Development into

  • Meta Platforms — Facebook Business and Ads Manager accounts
    Vulnerable versions: all
  • Multiple — Web browsers: Google Chrome, Microsoft Edge, Brave, Opera, Cốc Cốc, Mozilla Firefox
    Vulnerable versions: all

Remediation for Python NodeStealer Evolves via AI-Assisted Development into

Immediate actions

  • Hunt endpoints for keylog({ip}).txt in %TEMP%, and for C:\Users\Public\number.txt / C:\Users\Public\id.txt staging artifacts
  • Block or alert on the disclosed Telegram bot tokens and chat IDs at network egress / via Telegram API abuse reporting
  • Force credential resets and re-verify active sessions for Facebook Business and Ads Manager accounts belonging to potentially affected users
  • Enable MFA and review OAuth/Graph API token grants on Facebook Business and Ads Manager accounts
  • Block outbound traffic to vuagame[.]store and known sample hashes at the email/web gateway and EDR

Workarounds

  • Restrict outbound access to api.telegram.org from unapproved processes where feasible
  • Enforce browser policy to disable autofill of stored payment card data on managed endpoints

Longer-term hardening

  • Deploy EDR behavioral detection for Python processes importing/using pynput, pyperclip, and pyautogui outside approved automation tooling
  • Monitor for Windows Restart Manager API abuse (RmShutdown calls) targeting browser processes to unlock locked database files
  • Restrict unsigned/ad-hoc Python interpreter execution on endpoints and monitor Registry Run keys and the Startup folder for PowerShell-launched Python scripts
  • User awareness training for Facebook Business/Ads Manager account owners on Messenger-delivered 'defective product' attachment lures
  • Apply application allowlisting to restrict programmatic access to browser credential/cookie database files (Login Data, Cookies, Local State, Web Data)

Timeline of Python NodeStealer Evolves via AI-Assisted Development into

  • Palo Alto Networks Unit 42 traces the earliest JavaScript-based NodeStealer sample -- the predecessor to the later Python NodeStealer family -- to a July 2022 compile date.
  • Unit 42 dates the start of a distinct Python-compiled 'NodeStealer 2.0' campaign to approximately December 2022, running alongside continued use of the original JavaScript variant.
  • Meta identifies malicious NodeStealer activity beginning in January 2023, per Unit 42's account of Meta's findings on the JavaScript-based variant targeting Facebook business accounts.
  • Meta publicly reports on the original JavaScript-based NodeStealer campaign's theft of Facebook business-account credentials and cookies.
  • Palo Alto Networks Unit 42 publishes 'NodeStealer 2.0,' documenting two Python-compiled variants that add MetaMask cryptocurrency-wallet theft, full Facebook account-takeover functionality, a downloader for additional malware, and -- in Variant #2 -- anti-analysis/anti-VM checks and webmail-reading capability; attributes the campaign to a Vietnamese-based actor via Vietnamese code strings, Cốc Cốc browser targeting, and abuse of the hotmailbox.me and dongvanfb.net mailbox services for account-takeover operations.
  • Independent reporting (OODA Loop, citing Meta's original findings) attributes NodeStealer to Vietnamese-linked threat actors, citing Vietnamese-language code artifacts and targeting of the Cốc Cốc browser popular in Vietnam.
  • Netskope Threat Labs first documents Python-based NodeStealer targeting Facebook business accounts: theft of browser cookies/credentials across Chrome, Edge, Brave, Opera, Cốc Cốc, and Firefox, delivered via Facebook Messenger 'defective product' attachments hosted on Facebook's CDN and vuagame[.]store, persisting via a Startup-folder batch file that relaunches project.py.
  • Netskope reports a second-generation NodeStealer variant abusing Windows Restart Manager (RmShutdown) to unlock locked browser database files, padding payloads with tens of megabytes of junk code, wrapping scripts in batch files, adding credit-card theft from the 'Web Data' SQLite database, and pivoting to Facebook Ads Manager account/budget theft; the malware exits if the victim's IP geolocates to Vietnam.
  • Netskope publishes the corresponding IOC set to its public GitHub repository (NetskopeThreatLabsIOCs), including three SHA256 sample hashes, three Telegram bot tokens, three Telegram chat IDs, and staging-file artifact paths for the August 2026 spyware variant.
  • Netskope Threat Labs discloses a third-generation Python NodeStealer variant with full spyware capabilities -- pynput keylogging, pyperclip clipboard monitoring, pyautogui screenshot capture, Wi-Fi password extraction, and Pictures-folder exfiltration -- an expansion from 2 to 20+ abused Facebook Graph API endpoints, a dual-Telegram-bot exfiltration architecture, .pyc header timestomping, and code artifacts (decorative emoji in log output) indicating LLM-assisted development; targeting led by the financial services sector across Asia and North America.

Sources cited for Python NodeStealer Evolves via AI-Assisted Development into

More in malware

Detection coverage for TL-2026-2296

As of 2026-09-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2296 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats