Palo Alto Networks Unit 42 Researchers: NodeStealer 2.0, The Python Version: stealing Facebook Business Accounts 

Palo Alto Networks Unit 42 researchers have unveiled a new phishing campaign named NodeStealer 2.0, aimed at Facebook business accounts. The campaign entices victims with free business tools, like spreadsheet templates, to completely take over the accounts. This strategy indicates a concerning trend among threat actors, who have been increasingly targeting Facebook business accounts which emerged around July 2022.

 

In May 2023, Meta released a report on NodeStealer, a new information-stealing malware initially compiled in July 2022. The report highlighted malicious activities involving NodeStealer that were identified in January 2023. In December 2022, a campaign featuring a new version of Nodestealer emerged. This new campaign involved two Python-written variants with enhanced capabilities, including cryptocurrency theft, downloading abilities, and a complete takeover of Facebook business accounts.

 

Palo Alto Networks
Palo Alto Networks Unit 42 Researchers: NodeStealer 2.0, The Python Version: stealing Facebook Business Accounts

 

NodeStealer 2.0 Phishing Campaign 

The main infection vector was a phishing campaign focusing on advertising materials for businesses, allowing threat actors to steal browser cookies to hijack accounts on the platform, specifically aiming toward business accounts. The threat actor used multiple Facebook pages and users to post information, luring victims to download links from known cloud file storage providers. After clicking on it, a ZIP file was downloaded to the machine containing the malicious info stealer executable. 

 

“In early 2023, Meta reported it has reached 80.30 million Facebook users in the Philippines, equivalent to 69.0 percent of the total population at the start of the year. This extensive presence potentially exposes the country to considerable risks from NodeStealer, which greatly threatens individuals and organizations. Besides the direct impact on Facebook business accounts, which is mainly financial, the malware also steals credentials from browsers, which can be used for further attacks. We encourage all organizations to review their protection policies and use the indicators of compromise (IoCs) provided in this report to address this threat.” said Vicky Ray, Director at Unit 42 Cyber Consulting & Threat Intelligence, Asia Pacific & Japan at Palo Alto Networks.

 

Facebook business account owners are encouraged to use strong, complex, hard-to-guess passwords and enable multifactor authentication. Take the time to educate your organization on phishing tactics, especially modern, targeted approaches that address current events, business needs, and other appealing topics. 

Eli

Eli has 28 years of extensive IT sales expertise in Data, voice and network security and integrating them is his masterpiece. Photography and writing is his passion. Growing up as a kid, his father taught him to use the steel bodied Pentax and Hanimex 135mm film and single-direction flash, Polaroid cameras, and before going digital, he used mini DV tape with his Canon videocam. He now shoots with his Canon EOS 30D. Photography and blogging is a powerful mixture for him.

Leave a Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Back to top button