NodeStealer Malware Now Targets Facebook Business Accounts on Multiple Browsers

Sep 15, 2023THNOnline Security / Malware

An ongoing run is targeting Facebook Business accounts with bogus messages to harvest victims' credentials utilizing a variant of the Python-based NodeStealer and perchance instrumentality implicit their accounts for follow-on malicious activities.

"The attacks are reaching victims chiefly successful Southern Europe and North America crossed antithetic segments, led by the manufacturing services and exertion sectors," Netskope Threat Labs researcher Jan Michael said successful an investigation published Thursday.

First documented by Meta successful May 2023, NodeStealer originated arsenic a JavaScript malware susceptible of pilfering cookies and passwords from web browsers to compromise Facebook, Gmail, and Outlook accounts.

Palo Alto Networks Unit 42, past month, revealed a abstracted onslaught question that took spot successful December 2022 utilizing a Python mentation of the malware, with prime iterations besides designed to behaviour cryptocurrency theft.

The latest findings from Netskope suggest the Vietnamese menace actors down the cognition person apt resumed their onslaught efforts, not to notation follow tactics utilized by different adversaries operating retired of the state with the aforesaid objectives.

Just earlier this week, Guardio Labs disclosed however fraudulent messages sent via Facebook Messenger from a botnet of fake and hijacked idiosyncratic accounts are being leveraged to present ZIP oregon RAR archive files to present the stealer malware to unsuspecting recipients.

The aforesaid modus operandi acts arsenic the archetypal vector for the NodeStealer intrusion chains to administer RAR files hosted connected Facebook's contented transportation web (CDN).

"Images of defective products were utilized arsenic bait to person owners oregon admins of Facebook concern pages to download the malware payload," Michael explained.

Dive heavy into the aboriginal of SaaS information with Maor Bin, CEO of Adaptive Shield. Discover wherefore individuality is the caller endpoint. Secure your spot now.

These archives travel fitted with a batch publication that, erstwhile executed, opens the Chrome web browser and takes the unfortunate to a benign web page. But successful the background, a PowerShell bid is tally to retrieve further payloads, including the Python interpreter and the NodeStealer malware.

The stealer, too capturing credentials and cookies – careless of whether it is from Facebook oregon not – from assorted web browsers, is designed to stitchery strategy metadata and exfiltrate the accusation implicit Telegram.

"Compared to earlier variants, the caller NodeStealer variant uses batch files to download and tally Python scripts, and bargain credentials and cookies from aggregate browsers and for aggregate websites," Michael said.

"This run mightiness beryllium a doorway to a much targeted onslaught aboriginal connected since they person already gathered utile information. Attackers who person stolen Facebook cookies and credentials tin usage them to instrumentality implicit the account, marque fraudulent transactions leveraging the morganatic concern page."

Found this nonfiction interesting? Follow america connected Twitter  and LinkedIn to work much exclusive contented we post.