Netskope Threat Labs outlines NodeStealer spyware and expanded Facebook API scraping

Netskope Threat Labs reports a September 2026 analysis of an updated Python-based NodeStealer variant that adds full spyware functions and expands how the malware harvests Facebook data. The update matters to enterprise security teams because it combines browser data theft with identity-oriented information collection that can support downstream account compromise.

Research Overview

Netskope Threat Labs has tracked the Python-based NodeStealer since 2023. The research focuses on a newly observed variant found in August 2026 that the lab describes as incorporating major upgrades beyond earlier capabilities.

The blog describes the malware’s targeting of sensitive browser data and of Facebook user and Ads Manager accounts. It also outlines changes to data collection scope and supporting components, including exfiltration methods and packaging details.

Key Findings

The blog says the latest NodeStealer variant adds spyware capabilities including keylogging, clipboard monitoring, and screenshot capture. It also describes the expansion of theft targets to include Wi-Fi credentials, the victim’s Pictures folder, and additional browser data sources.

For Facebook-related activity, the blog states that earlier variants queried two Graph API endpoints, while the newest variant queries more than 20 endpoints. Netskope says this shifts collection from profiling account-level details to profiling the person managing the account, producing a broader dossier across identity, social graph, account security, and commerce-related categories.

Technical Breakdown

The blog describes keylogging implemented with the PyPI “pynput” library to monitor keyboard presses. It states that recorded keystrokes are saved to a temporary file and that a background process sends the file to a Telegram C2 channel every 120 seconds before deleting the contents.

For clipboard access, the blog says NodeStealer monitors paste activity using the PyPI “pyperclip” library and logs plain text placed in the clipboard. For screen capture, the blog says it uses the PyPI “pyautogui” library to take screenshots at execution and again before a function ends, with both screenshots sent to the Telegram C2 channel.

On command-and-control, the blog says previous variants relied on a single Telegram C2, while the updated version uses two distinct Telegram bot tokens. It describes the first bot as receiving a primary ZIP archive containing stolen browser credentials, passwords, and cookie databases, while the second receives Facebook-specific data.

The blog also discusses a compiled packaging detail, stating the analyzed sample is in .pyc format and carries the CPython 3.12+ magic number. It says the variant nulls out header fields so the timestamp appears as the Unix epoch and the recorded file size is set to 0, which Netskope characterizes as potentially intended to mislead researchers or disrupt automated decompilation workflows.

Leadership Perspective

Netskope frames the update as a move beyond earlier behavior that focused on Facebook Ads Manager data collection. The blog says the expanded collection produces identity-level exposure rather than only financial loss from drained ad accounts.

For defenders, the blog notes that it observed a .pyc distribution variant that packages the same capability set in CPython 3.12 bytecode with modified header fields. It says inspection tools should analyze Python bytecode regardless of header metadata, and it references its detection labels for Netskope Threat Protection.

Blog Signals brief: This summary reflects Netskope Threat Labs’ account of an August 2026 NodeStealer variant that adds keylogging, clipboard and screenshot capture, expanded Wi-Fi and Pictures theft, and broader Facebook Graph API endpoint querying supported by a split Telegram C2 design. It also covers .pyc header handling and the detection and IOC materials Netskope describes in its post.

Blog post, originally published by Jan Michael Alcantara at netskope.com.