NodeStealer Spyware Adds Keylogging, Screenshot Capture and Facebook Data Theft

Gbhackers •Mayura Kathir • September 4, 2026

A major upgrade to the Python-based NodeStealer malware, transforming the -focused infostealer into a broader spyware platform capable of logging keystrokes, monitoring clipboard data, capturing screenshots, and harvesting extensive profile information. The newly observed variant, identified in August 2026, also expands browser and local data theft, using a split Telegram command-and-control (C2) design to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

NodeStealer Spyware Enhances Capabilities for Continuous Surveillance NodeStealer, a Python-based malware, has been upgraded to include keylogging, clipboard monitoring, and screenshot capture, transforming it from a simple infostealer to a comprehensive spyware platform. This new variant, identified in August 2026, significantly increases the risk for victims by enabling continuous surveillance of sensitive information, including work, banking, and social media credentials. The malware employs a split Telegram command-and-control (C2) architecture to facilitate its operations. NodeStealer was first tracked in 2023, originally focusing on browser data theft, but the recent enhancements broaden its scope to include local data theft. Users of affected browsers and systems are at heightened risk as the malware can now log everything typed and capture screenshots. The current status indicates that the upgraded version is actively being observed in the wild, posing a serious threat to individuals and organizations alike. 2 sources 66

Extracted Entities

NodeStealer Spyware Adds Keylogging, Screenshot Capture and Facebook Data Theft

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (3)