Python NodeStealer malware adds keylogging and screenshots
Python NodeStealer, malware that used to just steal Facebook ad accounts, now works as full spyware. It can log every key you type, watch what you copy, and take screenshots of your screen.
- Report priority
- Medium
- Targets
- Facebook Ads Manager
How it works
- Netskope Threat Labs found an upgraded Python NodeStealer sample in August 2026.
- The malware now includes a keylogger built with the pynput library that records every keypress.
- A second module uses the pyperclip library to capture anything the victim copies to the clipboard.
- A third module takes screenshots when the malware runs.
- It also pulls Wi-Fi passwords, the victim's Pictures folder, and login data from two more browsers than earlier versions.
- The exact delivery method for this specific wave is not detailed beyond the malware's known history of fake Facebook messages and malicious attachments.
What to do
If you opened an unexpected file or attachment sent through a Facebook message or similar contact, do not open attachments or links from unexpected Facebook messages, even ones that appear to come from known contacts.
Facebook Business and Ads Manager admins should enforce phishing-resistant multi-factor authentication and limit admin access to as few people as possible.
Technical details
Affected software: Facebook Ads Manager
Netskope found the sample shipped as compiled Python bytecode with a nulled.pyc file header, zeroing out the timestamp and file-size fields to make it harder for researchers to analyze. It then split stolen data across two separate Telegram bots, one for browser passwords and cookies, the other for Facebook profile data.
The Python NodeStealer sample Netskope analyzed adds a pynput-based keylogger, a pyperclip clipboard monitor, and a screenshot routine, turning what was an ad-account credential thief into a broader spyware tool. It also expands theft to Wi-Fi passwords, the Pictures folder, and two additional browsers, and now queries over 20 Facebook Graph API endpoints instead of two, building a fuller profile of the account owner. Exfiltration goes through two separate Telegram bot tokens, one for general browser credentials and cookies, one for Facebook-specific data, which Netskope says adds resilience if one bot is shut down. The sample also ships as compiled Python bytecode with a nulled.pyc header to hinder analysis.