NodeStealer Can Now Record Everything Victims Type and Steal Their Screenshots
Brief
NodeStealer has returned with a more invasive toolkit. The Python-based information stealer can now record keystrokes, watch copied text, and capture victims’ screens, turning an account-stealing infection into continuous surveillance.
The change raises the stakes for people whose browsers hold work, banking, or social-media access. First tracked in 2023, NodeStealer initially focused on sensitive browser data and Facebook accounts.
It later widened its interest to Facebook Ads Manager accounts and payment-card information. The latest activity mainly affected victims in Asia and North America, with financial services the leading sector, but the campaign crossed several industries.
Netskope researchers identified the upgraded variant in August 2026 and said it adds spyware functions alongside the earlier theft features.