NodeStealer Can Now Record Everything Victims Type and Steal Their Screenshots

Cybersecuritynews •Tushar Subhra Dutta • September 4, 2026

NodeStealer has returned with a more invasive toolkit. The Python-based information stealer can now record keystrokes, watch copied text, and capture victims’ screens, turning an account-stealing infection into continuous surveillance. The change raises the stakes for people whose browsers hold work, banking, or social-media access. First tracked in 2023, NodeStealer initially focused on sensitive browser […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

NodeStealer Spyware Enhances Capabilities for Continuous Surveillance NodeStealer, a Python-based malware, has been upgraded to include keylogging, clipboard monitoring, and screenshot capture, transforming it from a simple infostealer to a comprehensive spyware platform. This new variant, identified in August 2026, significantly increases the risk for victims by enabling continuous surveillance of sensitive information, including work, banking, and social media credentials. The malware employs a split Telegram command-and-control (C2) architecture to facilitate its operations. NodeStealer was first tracked in 2023, originally focusing on browser data theft, but the recent enhancements broaden its scope to include local data theft. Users of affected browsers and systems are at heightened risk as the malware can now log everything typed and capture screenshots. The current status indicates that the upgraded version is actively being observed in the wild, posing a serious threat to individuals and organizations alike. 2 sources 66

Extracted Entities

NodeStealer Can Now Record Everything Victims Type and Steal Their Screenshots

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (3)