⚠️ Overview

NodeStealer is a JavaScript-based information stealer first documented by Meta’s security team in May 2023, operating as a trojan targeting browser-stored credentials, particularly for Facebook Business accounts and cryptocurrency wallets. It is attributed to a Vietnamese-speaking cybercriminal group tracked as "Ducktail" (also associated with the NodeStealer variant), and falls under the Stealer category, designed to exfiltrate session cookies and login data via fake browser extensions.

🔧 Technical Capabilities

NodeStealer propagates through spear-phishing emails containing malicious ZIP archives (e.g., “Business Proposal.zip”) that drop a JavaScript file (often disguised as a PDF logo or HR document). The malware leverages the Node.js runtime to execute its payload, which enumerates and copies login credentials, cookies, and two-factor authentication codes from Chromium-based browsers (Chrome, Edge, Brave) stored in the local “Login Data” and “Cookies” SQLite databases. It communicates with a command-and-control (C2) server via HTTP POST requests, sending exfiltrated data encoded in JSON format to IP addresses in Vietnam (e.g., 103.90.226.x). Persistence is achieved by adding a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. For evasion, NodeStealer checks for antivirus processes (avast.exe, avg.exe) and terminates itself if detected, and it also verifies the victim’s geolocation via an IP geolocation API to avoid targeting certain countries.

📜 History & Notable Incidents

NodeStealer first emerged in late 2022 but was publicly disclosed in May 2023 by Meta’s Threat Disruption team, which reported that it had compromised over 100,000 Facebook accounts through malicious browser extensions. In August 2023, a variant tracked as "NodeStealer 2.0" by Fortinet’s FortiGuard Labs added cryptocurrency wallet theft targeting MetaMask and Binance. No associated CVEs have been attributed to NodeStealer itself, but it exploits the inherent trust of browser extensions and Node.js execution. No known law enforcement actions have been taken against the group as of 2025.

🔍 Detection Indicators

Known file hashes include SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (from a sample analyzed by Cisco Talos). Behavioral indicators include unexplained JavaScript (.js) files in the %TEMP% directory, outbound DNS lookups to api.ipify.org for geolocation, and HTTP POST requests to C2 endpoints such as /api/collect. Registry persistence keys under HKCU...Run containing values like “NodeStealer” or random strings. User-Agent strings often mimic Google Chrome (e.g., Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36) to blend in with normal traffic.

☠️ Risk & Impact

NodeStealer causes significant financial and reputational damage by hijacking Facebook Business accounts, leading to unauthorized ad spend, stolen advertising budgets, and social engineering of followers. The cryptocurrency wallet variant can drain funds directly from MetaMask and Binance wallets, with losses per incident estimated in the hundreds of dollars to thousands. The targeted sectors are primarily small-to-medium businesses, digital marketing agencies, and individual social media managers reliant on Facebook for business operations.

🛡️ Mitigation

Mitigation includes enforcing multi-factor authentication (MFA) on all Facebook Business accounts, blocking execution of JavaScript files from untrusted email attachments via Group Policy Object (GPO), and deploying endpoint detection and response (EDR) rules to flag outbound connections to known Vietnamese C2 IP ranges. Meta has also provided a dedicated security tool that scans for and removes malicious browser extensions linked to NodeStealer.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.