NodeStealer has evolved from a browser and social-media credential thief into a broader surveillance tool. The latest variant can continuously record keystrokes, inspect clipboard text and capture the screen, giving its operators visibility into information that is never saved in a browser database. The additions increase the risk of fraud, account takeover and exposure of sensitive business data after a single endpoint infection.

First documented in 2023, the Python-based malware initially concentrated on browser secrets and Facebook accounts. Later versions targeted Facebook Ads Manager profiles and payment-card information. Researchers examining activity in August 2026 found victims across several industries in Asia and North America, with financial services most heavily represented.

Continuous collection goes beyond saved passwords

The new keylogger uses Python’s pynput library to capture keyboard input. Recorded text is written to a temporary file, sent to the main Telegram command channel every two minutes and then cleared so collection can continue. That cycle can expose passwords, private messages, customer records, search queries and other data entered during an infected session.

Clipboard monitoring complements the keylogger by collecting plain text that users copy and paste. This is especially important because password managers encourage people to paste strong passwords rather than type them. Clipboard access can also reveal cryptocurrency addresses, internal URLs, API tokens or fragments of confidential documents.

NodeStealer additionally takes a screenshot when its capture routine starts and another before it finishes, sending the images through Telegram. Screens can reveal one-time recovery codes, financial dashboards, open documents and chat conversations even when the malware cannot extract that data directly. Once screenshots leave the device, resetting a password cannot retrieve what was already exposed.

Facebook and advertising data remain central targets

The malware has substantially expanded its Facebook collection logic. New samples query more than 20 Graph API endpoints, compared with only two in earlier variants. The goal is no longer a basic account check: the stealer tries to assemble a detailed view of the user’s identity, contacts, interests, posts, pages, business records, advertising assets, integrations and login data.

For companies, compromise of an employee who manages social advertising can have consequences beyond the individual account. Criminals may use access to purchase unauthorized advertisements, consume campaign budgets, impersonate the business or build convincing approaches to colleagues and customers. Stolen cookies can also preserve an authenticated session and undermine the protection expected from a password change or multifactor authentication.

The samples separate stolen material between two Telegram bots. One receives an archive containing browser credentials, password stores and cookie databases; the other handles Facebook-specific data. Dividing collection channels may help operators organize large volumes of stolen information and make disruption more difficult.

Possible AI assistance and anti-analysis measures

Researchers observed repetitive, similarly structured API calls decorated with emoji labels in new functions, a coding pattern not seen in older NodeStealer versions. They assessed that portions may have been produced with AI assistance, although the pattern does not establish which tool was used or who wrote the code. The practical point is that commodity malware authors may be able to add features more quickly, even if generated code remains imperfect.

The malware is delivered as compiled Python bytecode with modified header data. Those changes appear intended to obscure the compilation timeline and may interfere with automated analysis that relies too heavily on metadata. Security tools and analysts should inspect suspicious Python artifacts even when their headers are inconsistent or incomplete.

What defenders and account owners should do

• Investigate unexpected Python executables, persistent keyboard hooks and access to browser profile databases.
• Monitor endpoints for temporary files matching keylogging patterns and unusual archives sent to Telegram infrastructure.
• After suspected infection, isolate the host, reset credentials from a clean device and revoke active browser and social-media sessions.
• Review Facebook business integrations, administrator lists, payment methods and recent advertising changes.
• Keep browsers and endpoint defenses current, restrict local administrative rights and train users to reject untrusted downloads.

The initial delivery route for the analyzed variant has not been confirmed, so defenders should avoid building controls around one presumed lure. Detection should instead focus on the behaviors that define the compromise: browser-data access, recurring key capture, screen collection, Telegram exfiltration and unauthorized use of business accounts.