Node Stealer 2.0 – The Python Version: Stealing Facebook Business Accounts
Summary: Unit 42 researchers documented a previously unreported phishing campaign, starting around December 2022, that distributed two Python variants of NodeStealer compiled with Nuitka and delivered through Facebook pages and users posting links to cloud file storage. The malware checked for logged-in Facebook business accounts via business.facebook.com, pulled account data through the Graph API, stole browser credentials from Chrome, Edge, Cốc Cốc, Brave and Firefox, and exfiltrated the output through Telegram.
Key Takeaway: Variant #2 replaced the victim's Facebook business account email with a mailbox bought from a Vietnamese service using an embedded API key, taking over the account without needing the password - and the same malware also lifted MetaMask credentials from Chrome, Cốc Cốc and Brave.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026