NodeStealer: A Facebook Hack to be Aware of

07.11.23

Threat Intelligence Alerts

NodeStealer is a type of malware that can be used to steal Facebook accounts. It’s relatively new and was first discovered by Meta’s security team in January 2023. NodeStealer is distributed through malicious ads, and once installed on a victim’s device, it can steal browser cookies and passwords, which can then be used to hijack Facebook accounts.

In a recent campaign, hackers used NodeStealer to hijack Facebook business accounts. They then used these accounts to run bogus ads that lured victims into downloading the malware. The ads used provocative photos of young women to trick victims into clicking on them. Once victims click on an ad, they download an archive containing a malicious .exe file. This file, when executed, would install NodeStealer on the victim’s device.

Once NodeStealer was installed on the victim’s device, the hackers could steal their Facebook login credentials and other personal information. They could then use this information to hijack the victim’s Facebook account.

There are a few things you can do to protect yourself from NodeStealer:

If you think you may have been infected with NodeStealer, you should take the following steps:

At the Cyber and Fraud Centre, we regularly get reports of Facebook and Instagram accounts being compromised. Users should be aware that if their account has been compromised and the threat actors update the security details, then the chances of your account being recovered via the Meta account recovery process are extremely low. To date, we’ve heard of no accounts that have even been recovered via the platform’s support systems.

NodeStealer is a severe threat to Facebook users. It is important to be aware of this malware and take steps to protect yourself. 

https://www.bitdefender.com/blog/labs/nodestealer-attacks-on-facebook-take-a-provocative-turn-threat-actors-deploy-malvertising-campaigns-to-hijack-users-accounts/

https://thehackernews.com/2023/11/nodestealer-malware-hijacking-facebook.html

https://medium.com/@m4st3r5cr1pt3r/nodestealer-unlocking-the-malvertising-campaign-within-facebook-8c6d442197ad