Wednesday , February 26 2025
Hacker

Python NodeStealer: harvest credit card and Facebook Ads Manager

Jan Michael Alcantara of Netskope Threat Labs reported, Python NodeStealer has resurfaced with advanced techniques and a broader target range. The report shows that primarily the infostealer to target Facebook business accounts and harvests credit card information.

The malware targets Facebook Ads Manager accounts to steal login details, cookies, and budget information through Facebook’s Graph API. Attackers log into adsmanager.facebook.com using the victim’s cookies to access financial data like daily ad spending limits and total campaign budgets.

Hackers Exploits RCE flaw in Cisco Small Business Router

Cybersecurity researchers have discovered a campaign exploiting a remote command execution vulnerability, CVE-2023-20118, in Cisco Small Business Routers. This vulnerability...
Read More
Hackers Exploits RCE flaw in Cisco Small Business Router

CISA Alerts For Active Exploited Zimbra and Microsoft flaw

CISA has added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog, urging organizations to quickly patch their systems to...
Read More
CISA Alerts For Active Exploited Zimbra and Microsoft flaw

200 Fake GitHub Repos Attacking Developers to Deliver Malware

A new cyber campaign called GitVenom poses a serious risk to developers. Security researchers found over 200 fake GitHub repositories...
Read More
200 Fake GitHub Repos Attacking Developers to Deliver Malware

Renew Dubai visa within minutes with AI-powered Salama

Residents of Dubai can now easily renew their visas with the new AI-powered digital platform launched by the General Directorate...
Read More
Renew Dubai visa within minutes with AI-powered Salama

CVE-2024-20953
CISA Flags Oracle Agile PLM Actively Exploited Security Flaw

CVE-2024-20953 is a vulnerability in Oracle Agile PLM, a product lifecycle management tool. With a CVSS score of 8.8, it...
Read More
CVE-2024-20953  CISA Flags Oracle Agile PLM Actively Exploited Security Flaw

Stablecoin Bank Hacked – Hackers Stolen $49.5M

Days after the biggest crypto hack ever, another platform has experienced a major exploit. Infini Earn, a decentralized stablecoin bank,...
Read More
Stablecoin Bank Hacked – Hackers Stolen $49.5M

CVE-2025-20029
PoC Exploit Released for F5 BIG-IP Command Injection Vuln

Security researchers have released a proof-of-concept exploit for CVE-2025-20029, a serious command injection vulnerability in F5’s BIG-IP application delivery controllers....
Read More
CVE-2025-20029  PoC Exploit Released for F5 BIG-IP Command Injection Vuln

By 1 April 2025
Australia Bans Kaspersky on its govt systems and devices

On February 21, the Australian Department of Home Affairs issued a directive prohibiting the installation of Kaspersky Lab products and...
Read More
By 1 April 2025  Australia Bans Kaspersky on its govt systems and devices

CISA Flags Craft CMS Code Injection Flaw Amid Active Attacks

CISA has added a serious security flaw in the Craft content management system (CMS) to its Known Exploited Vulnerabilities catalog...
Read More
CISA Flags Craft CMS Code Injection Flaw Amid Active Attacks

B1ack’s Stash Releases 1 Million Credit Cards on a Deep Web Forum

On February 19, 2025, the illegal marketplace B1ack's Stash released over 1 million unique stolen credit and debit card details...
Read More
B1ack’s Stash Releases 1 Million Credit Cards on a Deep Web Forum

Netskope researchers believe that targeting Ads Manager aims to use stolen accounts for harmful advertising campaigns, which may involve fraudulent promotions or malvertisements that spread more malware.

NodeStealer not only targets Facebook accounts but now also steals credit card information. It copies the “Web Data” SQLite database from browsers to extract cardholder names, expiration dates, and card numbers. By using Python’s SQLite3 library, it queries stored payment data, expanding its threat significantly.

NodeStealer’s new variants cutting edge methods:

Researchers found that some Python NodeStealer variants use Windows Restart Manager to unlock database files. This library minimizes the need for reboots during software updates by restarting processes that lock files. In this case, the malware exploits Restart Manager to steal information. By using legitimate Windows components, attackers can avoid detection while carrying out their activities.

The malware now uses PowerShell to automatically run its Python script when the system starts.

Junk code and batch files often contain a lot of unnecessary code to avoid detection. Some even use batch files to create and run harmful scripts on the fly.

NodeStealer uses Telegram to steal and send credentials, IP addresses, hostnames, and countries of victims without being detected.

NodeStealer avoids targeting victims in Vietnam, where its operators likely reside. It checks the victim’s IP location using ipinfo and stops if the country code is “VN.”

Check Also

1 million

B1ack’s Stash Releases 1 Million Credit Cards on a Deep Web Forum

On February 19, 2025, the illegal marketplace B1ack’s Stash released over 1 million unique stolen …

Leave a Reply

Your email address will not be published. Required fields are marked *