Security researchers are raising alarms about an updated version of the Python-based NodeStealer malware. This iteration not only harvests sensitive information from Facebook Ads Manager accounts but also extracts credit card data stored in web browsers.
"They collect budget details of Facebook Ads Manager accounts of their victims, which might be a gateway for Facebook malvertisement," said Jan Michael Alcantara, a Netskope Threat Labs researcher, in a report shared with The Hacker News.
The malware now incorporates several new features, including:
- Windows Restart Manager to unlock browser database files.
- Addition of junk code to obscure its true functionality.
- Use of batch scripts to dynamically generate and execute Python code.
NodeStealer’s Evolution
Initially discovered by Meta in May 2023, NodeStealer began as JavaScript malware. It later transitioned into a Python-based tool designed to hijack Facebook accounts, primarily to take over advertising and business accounts.
Researchers believe NodeStealer is developed by Vietnamese threat actors, known for targeting Facebook business accounts to facilitate malvertising and other malicious activities.
Latest Targets: Facebook Ads Manager Accounts
According to Netskope, the newest versions of NodeStealer aim to:
- Collect account budget details via the Facebook Graph API.
- Generate access tokens using cookies from compromised machines to log into Facebook Ads Manager.
Alcantara noted:
"We recently found several Python NodeStealer samples that collect budget details of the account using Facebook Graph API."
Interestingly, NodeStealer includes geofencing techniques to avoid infecting devices in Vietnam, likely to evade local law enforcement.
Data Exfiltration via Telegram
The malware uses Telegram to exfiltrate stolen data, showcasing the persistent use of messaging platforms by cybercriminals.
Additionally, the malware exploits the Windows Restart Manager to unlock SQLite database files, potentially containing credit card data.
Facebook Malvertising and Beyond
Malvertising campaigns on Facebook, impersonating popular brands, are a lucrative pathway for spreading malware. One campaign, starting November 3, 2024, mimicked the Bitwarden password manager software to distribute a rogue Google Chrome extension via sponsored ads.
Bitdefender reported:
"The malware gathers personal data and targets Facebook business accounts, potentially leading to financial losses for individuals and businesses."
Phishing Campaigns and ClickFix Technique
The NodeStealer threat coincides with a surge in phishing campaigns deploying malware like I2Parcae RAT. These campaigns exploit techniques such as:
- Using contact forms and invoice-themed lures.
- Fake CAPTCHA pages urging victims to execute malicious scripts.
The “ClickFix” technique, highlighted by Proofpoint researchers, has become a popular method to bypass security controls. This technique manipulates users into infecting their devices by executing malicious code themselves.
"What's insidious about this technique is the adversaries are preying on people's innate desire to be helpful," said Tommy Madjar and Selena Larson.
