Python NodeStealer, a notorious infostealer previously known for targeting Facebook Business accounts, has now been enhanced with new, dangerous capabilities that allow it to infiltrate Facebook Ads Manager accounts. This upgrade not only boosts its ability to steal more data but also paves the way for even more malicious campaigns.

In an extensive analysis by cybersecurity experts at Netskope Threat Labs, it was revealed that the infostealer is now capable of stealing credit card information in addition to previously targeted browser credentials. 

The new attack vector involves copying the “Web Data” from browsers, a SQLite database containing sensitive data like autofill details and saved payment methods.

“With these, the infostealer can now collect the victim’s credit card information which includes the cardholder’s name, card expiration date, and card number,” the researchers pointed out. To access this information, NodeStealer uses Python’s SQLite3 library to run specific queries on the stolen database, looking for credit card-related data.

The new version of Python NodeStealer also abuses Windows Restart Manager, a tool typically used to manage reboots after software updates. In this case, however, the tool is leveraged to bypass locked database files that contain valuable data. By extracting browser database files into a temporary folder, NodeStealer circumvents file locks, and exfiltrates the data via a Telegram bot.

Most likely developed by a Vietnamese cybercriminal group, Python NodeStealer’s primary targets are Facebook Business and Ads Manager accounts, which are then exploited in malvertising campaigns. Since Facebook’s stringent vetting process for ad purchases typically prevents unauthorized ads, cybercriminals now resort to stealing verified accounts to run their malicious ads instead.