Loading story…
Netskope Threat Labs identified a Python-based NodeStealer variant that expands the malware from a browser and Facebook-focused information stealer into a spyware platform. The updated malware persistently logs keystrokes, monitors clipboard contents, captures screenshots during execution, and steals Wi-Fi passwords and files from victims’ Pictures directories, alongside browser credentials, cookies, payment-card data, and Facebook account information. Activity observed in August primarily affected targets in Asia and North America, with financial services the most affected sector.
NodeStealer now queries more than 20 Facebook Graph API endpoints—up from two—to collect identity, social-network, content, advertising, commerce, and account-security data. It uses a split Telegram bot infrastructure for command-and-control and data exfiltration, enabling theft of Facebook Ads Manager assets that could support account takeover, fraud, impersonation, and misuse of business advertising accounts. Samples were distributed as compiled Python 3.12+ bytecode with altered header metadata, a technique that may hinder automated analysis and compilation-timeline assessment; researchers also found signs of possible LLM-assisted code development.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Netskope identified a substantially upgraded NodeStealer variant that added persistent keylogging, clipboard collection, screenshot capture, theft of Wi-Fi passwords and Pictures-folder data, and expanded Facebook Graph API collection. The observed activity primarily affected victims in Asia and North America, with financial services the leading targeted sector.
Netskope Threat Labs began tracking NodeStealer, a Python-based information stealer targeting sensitive browser data and Facebook accounts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcenetskope.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed ongoing Snake Keylogger activity in which attackers deliver the .NET-based infostealer through phishing emails carrying archive files, malicious executables, exploit-laden RTF documents abusing `CVE-2017-11882`, and Excel attachments with password-protected VBA macros. In one analyzed chain, a lure such as `SeptemberOrderlist.pdf.exe` decrypted intermediate .NET assemblies before launching the final payload, while another used base64-encoded PowerShell to download a Snake downloader, retrieve an RC4-encrypted DLL, and deploy the malware through process hollowing. Snake is designed to steal credentials and other sensitive data from more than 50 applications, including browsers, email and FTP clients, communication tools, wireless profiles, and Windows product information, while also capturing keystrokes, screenshots, clipboard contents, host details, geolocation, and time data. The malware can persist through scheduled tasks or Startup-folder registry changes, evade defenses by killing security tools, adding Windows Defender exclusions, and deleting itself, and exfiltrate stolen data over SMTP, FTP, or Telegram via HTTPS. Multiple researchers said Snake shares strong code and loader similarities with commodity stealers such as FormBook, Agent Tesla, Matiex, 404, Cheetah, and Phoenix, pointing to code reuse or shared tooling in the cybercrime ecosystem.
Aug 15, 2026
Threat actors used fake Facebook job advertisements and impersonation content, including lures themed around Amazon CEO Andy Jassy and DocuSign, to distribute the Windows information stealer **Ov3r_Stealer**. Trustwave SpiderLabs found victims were redirected to Discord-hosted `.url` shortcut files and, in some cases, weaponized PDFs, which triggered a multi-stage infection chain involving `control.exe`, malicious `.cpl` loaders, PowerShell scripts fetched from GitHub, and a final DLL sideloading payload delivered from a remote SMB share. Once installed, **Ov3r_Stealer** established persistence through scheduled tasks running every 90 minutes and harvested browser credentials, crypto wallets, FTP and Discord data, documents, and system information before exfiltrating the data to attacker-controlled Telegram bots and channels. Researchers said the malware was under active development, with alternate delivery methods including HTML smuggling, SVG smuggling, and LNK masquerading, and noted strong similarities to the open-source **Phemedrone Stealer**; the activity was linked to aliases including **Liu Kong**, **John Macollan**, **MR Meta**, and **MeoBlackA**, with indications the operator may be offering the malware as a service.
Aug 14, 2026
Researchers detailed how **Snake Keylogger**—also tracked as **404 Keylogger**—continues to spread through multi-stage infection chains that begin with phishing documents or other loaders and end in credential theft, surveillance, and data exfiltration. One analyzed campaign used a malicious Microsoft Word file with VBA macros that dropped an `.inf` file into `%TEMP%` and abused `LaunchINFSectionW` from `Advpack.dll` to execute the next stage through legitimate Windows components. That chain then used built-in tools to reconstruct and launch a disguised DLL downloader, which attempted to fetch an additional payload from a remote command-and-control endpoint. Separate technical analyses describe Snake as a long-running **malware-as-a-service** operation with modular .NET payloads, in-memory decryption, steganographic extraction of components, and execution techniques including process injection and process hollowing. The malware is designed to steal browser, email, FTP, Discord, and Wi-Fi credentials; log keystrokes; capture screenshots and clipboard data; profile infected hosts; and evade analysis through anti-debugging checks and termination of security tools. Researchers also reported persistence through registry keys, startup items, or scheduled tasks, and exfiltration over channels including **Telegram**, **SMTP**, and **FTP**, while linking the family to variants such as **Matiex**, **Cheetah**, and **Nova**.
Jul 13, 2026