NodeStealer Spyware Enhances Capabilities for Continuous Surveillance

NodeStealer, a Python-based malware, has been upgraded to include keylogging, clipboard monitoring, and screenshot capture, transforming it from a simple infostealer to a comprehensive spyware platform. This new variant, identified in August 2026, significantly increases the risk for victims by enabling continuous surveillance of sensitive information, including work, banking, and social media credentials. The malware employs a split Telegram command-and-control (C2) architecture to facilitate its operations. NodeStealer was first tracked in 2023, originally focusing on browser data theft, but the recent enhancements broaden its scope to include local data theft. Users of affected browsers and systems are at heightened risk as the malware can now log everything typed and capture screenshots. The current status indicates that the upgraded version is actively being observed in the wild, posing a serious threat to individuals and organizations alike.

Key Points: • NodeStealer now includes keylogging and screenshot capabilities. • The malware targets sensitive information across browsers and local systems. • Recent upgrades have turned NodeStealer into a continuous surveillance tool.