Facebook Foils New NodeStealer Malware Designed to Steal Information

Meta, the parent company of Facebook, has announced that it thwarted a new malware called NodeStealer, which emerged earlier this year and was designed to steal cookies and login credentials from various web browsers. The malware, which was distributed disguised as PDF and XLSX files, was first identified by Meta roughly two weeks after it was deployed and was likely of Vietnamese origin.

Meta took immediate action to neutralize the threat, including contacting appropriate service providers and submitting takedown requests. The company has announced that their efforts to disrupt NodeStealer have been successful, and no new samples of the malware have been observed since February 2023.

NodeStealer is a new malware that is executed through Node.js, written in JavaScript. This characteristic enables the malware to run on Windows, macOS, and Linux, making it highly versatile. Additionally, the malware is highly stealthy, with most AV engines on VirusTotal failing to flag it as malicious.

The malware is distributed as a 46-51MB Windows executable file that is disguised to appear as a PDF or Excel document with a name that piques the recipient’s interest. Once launched, NodeStealer uses Node.js’ auto-launch module to establish persistence on the victim’s machine between reboots. The malware adds a new registry key during launch, enabling it to remain undetected and active on the victim’s machine.

NodeStealer malware steals cookies and account credentials for Facebook, Gmail, and Outlook from various web browsers. It retrieves the base64-encoded decryption key to access encrypted data and abuses Facebook API to extract information about breached accounts while hiding requests behind the victim’s IP address to evade detection.

The malware steals the Facebook account’s ability to run advertising campaigns, promoting misinformation or leading unsuspecting audiences to malware distribution sites. NodeStealer ultimately sends the stolen data to the attacker’s server.

Facebook took down the server of the threat actor responsible for NodeStealer on January ‘2023, after discovering it. The social media giant also released information on DuckTail malware operations and malicious extensions distributed as ChatGPT programs. Facebook has shared IOCs related to these threats on their public GitHub repository.