Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
High
Cybersecurity researchers discovered a Python variant of a malware called NodeStealer, which has been actively targeting Facebook business accounts and cryptocurrency wallets in a phishing campaign since December 2022. The NodeStealer malware is designed to steal browser cookies, allowing it to hijack accounts on various platforms, including Facebook, Gmail, and Outlook.
“NodeStealer poses great risk for both individuals and organizations. Besides the direct impact on Facebook business accounts, which is mainly financial, the malware also steals credentials from browsers, which can be used for further attacks.”
The malware was first identified in late January 2023, specifically targeting browsers on Windows systems, but it can also affect popular web browsers such as Google Chrome, Microsoft Edge, Brave, and Opera. The variant disclosed by Meta (Facebook’s parent company) in May was a custom JavaScript malware bundled with the Node.js environment, enabling it to execute on different operating systems, including Windows, Linux, and macOS. It is believed to originate from Vietnam, distributed by threat actors from the same region.
The phishing campaign employed by the threat actors involved sending messages that contained download links to a .zip archive hosted on well-known cloud file storage providers like Google Drive. This .zip file contained the malicious NodeStealer executable.
Two variants of the Python-based NodeStealer were identified. The first variant could steal Facebook business account information, download additional malware, disable Windows Defender via GUI, and steal funds from the MetaMask cryptocurrency wallet by using stolen credentials from various web browsers.
The second variant had additional features, such as parsing emails from Microsoft Outlook, exfiltrating data via Telegram, taking full control of the Facebook account, and possessing anti-analysis capabilities. These enhancements were likely aimed at increasing potential profits for the threat actors.
comparison of NodeStealer with its two variants
Upon execution, the NodeStealer malware checked if a Facebook business account was logged in on the infected machine and, if found, connected to the Graph API with stolen user ID and access tokens to extract information about the target, including followers count, verification status, account credit balance, prepaid status, and ads information.
NodeStealer is part of a rising trend among Vietnamese threat actors, similar to malware such as Ducktail. These actors are increasingly targeting Facebook business accounts for advertising fraud and spreading malware to other users on the social media platform.
The report emphasizes that NodeStealer poses a significant threat to both individuals and organizations, as it can steal credentials from web browsers, enabling further attacks. The potential damage could extend to financial loss and reputation damage for the targeted entities.
The continuous development and sophistication of NodeStealer variants underscore the importance of remaining vigilant against such cyber threats.
“Facebook business account owners are encouraged to use strong passwords and enable multi factor authentication. Take the time to provide education for your organization on phishing tactics, especially modern, targeted approaches that play off current events, business needs and other appealing topics”, they conclude