Python NodeStealer: AI-Assisted to Full Spyware

Since 2023, Netskope Threat Labs has been tracking the Python-based NodeStealer, an infostealer targeting sensitive browser data and Facebook user, and Ads Manager accounts. In August 2026, we found a new variant with major upgrades. Aside from its previous features, it now has full spyware capabilities, including keystroke logging, clipboard monitoring, screenshot capture, and a dual bot Telegram C2 architecture. We suspect these new capabilities were written with AI assistance. Additionally, the malware’s targeting of Facebook data shifts from extracting basic account details to build a much more complex picture of the user managing the accounts, querying more than 20 Facebook Graph API endpoints covering the victim’s identity, social graph, account security, and commerce data. The campaign’s target victims were mainly in Asia and North America, spread across a number of segments, but led by the financial services sector.

Key findings

• Python NodeStealer adds new spyware capabilities
  The latest Python NodeStealer variant incorporates new spyware features, including keylogging, clipboard monitoring, and screenshot capture. In addition, it expands its theft targets to include Wi-Fi passwords, the victim’s Pictures folder, and two additional web browsers.
• AI assisted upgrade 
  Newly added code exhibits characteristics consistent with LLM-generated code. This is most prominent in the systematic use of decorative emojis within output logs, a practice absent in previous NodeStealer variants.
• Facebook targeting shifts from profiling account to the user managing it
  Earlier NodeStealer variants queried only two Facebook Graph API endpoints. The latest variant queries more than 20 endpoints to construct a comprehensive dossier on the individual managing the account, enabling cyberattackers to conduct cross-platform account takeovers, impersonation scams, and higher-value data resale.

NodeStealer expanded targets and AI-assisted capabilities

In September 2023, Netskope Threat Labs reported a Python-based NodeStealer targeting Facebook credentials and sensitive browser data. A year later, we observed that it had expanded the data it targets, looking for Facebook Ads Manager accounts and credit card information. We have now found that NodeStealer has expanded its capabilities and targets even more, incorporating what appear to be AI-assisted functionalities. The following sections highlight what’s new.

Spyware features

The latest NodeStealer variants now include spyware capabilities, such as keylogging, clipboard monitoring, and screenshot capture.

Keylogger

The new Python NodeStealer uses pynput library to monitor keyboard presses. All recorded keystrokes are saved in the temporary folder using keylog({ip}).txt file name. A separate Python thread runs in the background, sending the text file to the main Telegram C2 channel every 120 seconds, subsequently deleting the contents. This keyboard logger persists indefinitely, meaning the actor receives the victim’s keystrokes including typed passwords or any other sensitive data entered at the keyboard.

Clipboard monitor

To capture sensitive data that users copy and paste rather than type manually, cyberattackers monitor clipboard paste activity using the pyperclip library. Any plain text pasted to the clipboard is logged and sent to the same Telegram C2 channel, accompanied by the victim’s IP address for identification.

Screenshot capture

Python NodeStealer now captures a screenshot of the victim’s monitor using the pyautogui library. Screenshots are captured at the moment of execution and another one right before the execution of the function ends. Both screenshots are sent to the Telegram C2 channel.

Facebook profile harvesting

Similar to the previous NodeStealer versions analyzed, the latest variants analyzed still target Facebook accounts, but have pivoted from profiling accounts to profiling the person managing the accounts. Cyberattackers still target ads and business manager accounts, and the full query set which includes identity, social graph, account security, and commerce data builds a dossier on victims. This can lead to further attacks including account takeover across platforms, impersonation for scams, and additional resale value.

The new variants queries more than 20 Graph API endpoints, compared to two from the previous variants.

Split C2 architecture

While previous variants relied on a single Telegram C2, the latest NodeStealer variants now incorporate two distinct Telegram bot tokens for separate purposes. The main Telegram bot receives the primary ZIP archive containing all stolen browser credentials, passwords, and cookie databases. This is the operational data an access broker or threat actor needs. The second Telegram bot receives only the Facebook-specific data listed on the previous section.

We suspect two possible reasons for the split. First is operational specialization. Splitting two C2 allows an attacker to route two distinct streams of data into a separate operational pipeline. The other is for resilience and redundancy. If one Telegram bot token gets burned, the other remains active.

Nulled .pyc header

The Python NodeStealer analyzed is in .pyc format. A pyc file is a Python script compiled into bytecode. It contains a magic number identifying the CPython version, a 4-byte timestamp recording when the Python source code was compiled, and a 4-byte field recording the size of the source file. The latest variant carries the CPython 3.12+ magic number, but nulls out the remaining header fields. This sets the timestamp to Unix epoch (Thu Jan 1 00:00:00 1970 UTC) and the file size set to 0. Nulling these fields may be an attempt to mislead researchers regarding the compilation timeline, and possibly to disrupt automated decompilation pipelines.

AI assisted for new capabilities

We found indicators that the added functions to the Python NodeStealer were AI-assisted. One new method named save_additional_info enumerates more than 20 Facebook Graph API endpoints in a single block, each with a distinct emoji label and identically structured method calls. This may be the result of a wide range prompt like “collect all available Facebook data”. Emoji are present in all the new methods, but not found in any of the old code or previous samples we analyzed.

Conclusions

Python NodeStealer has moved well past its origins as a basic Facebook Ads Manager stealer. The latest variant is a capable spyware platform. It logs keystrokes indefinitely, monitors the clipboard, captures the victim’s screen upon execution, extracts Wi-Fi credentials, and exfiltrates an entire Pictures directory. The abuse of 20+ Graph API endpoints means victims face identity-level exposure, not just financial loss from drained ad accounts.

We also found a compiled .pyc distribution variant, packaging the same capability set in CPython 3.12 bytecode with modified header fields. Defenders should ensure their inspection tools analyze Python bytecode regardless of header metadata.

Netskope Threat Labs will continue to monitor Python NodeStealer and similar infostealers.

IOCs

All the IOCs and scripts related to this malware can be found in our GitHub repository.

Netskope Detection

• Netskope Threat Protection
  • Script-Python.Infostealer
  • Trojan.Stealer.130
  • Trojan.Generic.39958647