Cybersecurity researchers discovered a Python variant of a malware called NodeStealer, which has been actively targeting Facebook business accounts and cryptocurrency wallets in a phishing campaign since December 2022. The NodeStealer malware is designed to steal browser cookies, allowing it to hijack accounts on various platforms, including Facebook, Gmail, and Outlook.
“NodeStealer poses great risk for both individuals and organizations. Besides the direct impact on Facebook business accounts, which is mainly financial, the malware also steals credentials from browsers, which can be used for further attacks.”
The phishing campaign employed by the threat actors involved sending messages that contained download links to a .zip archive hosted on well-known cloud file storage providers like Google Drive. This .zip file contained the malicious NodeStealer executable.
Two variants of the Python-based NodeStealer were identified. The first variant could steal Facebook business account information, download additional malware, disable Windows Defender via GUI, and steal funds from the MetaMask cryptocurrency wallet by using stolen credentials from various web browsers.
The second variant had additional features, such as parsing emails from Microsoft Outlook, exfiltrating data via Telegram, taking full control of the Facebook account, and possessing anti-analysis capabilities. These enhancements were likely aimed at increasing potential profits for the threat actors.
comparison of NodeStealer with its two variants
Upon execution, the NodeStealer malware checked if a Facebook business account was logged in on the infected machine and, if found, connected to the Graph API with stolen user ID and access tokens to extract information about the target, including followers count, verification status, account credit balance, prepaid status, and ads information.
NodeStealer is part of a rising trend among Vietnamese threat actors, similar to malware such as Ducktail. These actors are increasingly targeting Facebook business accounts for advertising fraud and spreading malware to other users on the social media platform.
The report emphasizes that NodeStealer poses a significant threat to both individuals and organizations, as it can steal credentials from web browsers, enabling further attacks. The potential damage could extend to financial loss and reputation damage for the targeted entities.
The continuous development and sophistication of NodeStealer variants underscore the importance of remaining vigilant against such cyber threats.
“Facebook business account owners are encouraged to use strong passwords and enable multi factor authentication. Take the time to provide education for your organization on phishing tactics, especially modern, targeted approaches that play off current events, business needs and other appealing topics”, they conclude