Pierluigi Paganini
May 04, 2023
NodeStealer is a new information-stealing malware distributed on Meta that allows stealing browser cookies to hijack accounts on multiple platforms, including Facebook, Gmail, and Outlook.
The malware was first spotted in late January 2023 while targeting the browsers of Windows systems. It can target multiple web browsers, including Google Chrome, Microsoft Edge, Brave, and Opera.
The researchers explained that NodeStealer is a custom Javascript malware that bundles the Node.js environment. The author uses Node.js to allow malware execution on multiple OS, including Windows, Linux, and macOS.
The info stealer is believed to have a Vietnamese origin and was allegedly distributed by threat actors from Vietnam.
The social network giant took action to disrupt the malware campaign and support victims in recovering their accounts.
The malware is disguised as PDF and XLSX files and their filename was chosen to trick victims into opening them starting the infection process.
“As part of this effort, we submitted takedown requests to third-party registrars, hosting providers, and application services such as Namecheap, which were targeted by these threat actors to facilitate distribution and malicious operations.” reads the post published by Facebook. “These actions led to a successful disruption of the malware. We have not observed any new samples of malware in the NodeStealer family since February 27 of this year and continue monitoring for any potential future activity.”
The good news is that Facebook discovered the threat within two weeks of it being distributed
At the time of its discovery, the malicious code had a single detection on the VirusTotal platform.
One of the samples analyzed by the company was a Windows executable file disguised as a PDF file with a PDF icon. The threat actors changed the metadata in an attempt to disguise the file as a ‘MicrosoftOffice’ product.
This sample is written in Javascript, executed using Node.js, and compiled into a Windows executable using a tool from the Node Package Manager (NPM) called pkg. This sample is around 46 MB in size, but experts discovered files with a size between 46 and 51 MB.
NodeStealer maintains persistence using the auto-launch module on Node.js.
The Chrome browser encrypts the user’s information before storing it, the encrypted_key is stored in the “Local State” file and Base64 encoded.
The info-stealer retrieves the base64-encoded decryption key from the Chromium “Local State” file and decrypts data stored by the browsers SQLite database.
“After retrieving the decryption key, the malware reads data from the “Cookies” file, which is an SQLite database containing cookie values. The malware looks for a Facebook session cookie and will only continue if one is found.” continues the report. “If no Facebook session cookie is found, the malware does not extract more information”
Once found cookies or credentials related to Facebook accounts, NodeStealer uses Facebook API to enumerate advertising information about the compromised account.
“The malware gains access to this information by making requests from the targeted user’s computer to the APIs used by our Facebook web and mobile apps, which masquerades its activity behind the user’s actual IP address, cookie values, and system configuration – appearing like a legitimate user and their session. This makes detection of this activity significantly more difficult.” continues the report. “The stolen information then enables the threat actor to assess and then use users’ advertising accounts to run unauthorized ads.”
NodeStealer exfiltrates the stolen data to the attacker’s server in a JSON object that is Base64 encoded.
Facebook provided indicators of compromise (IOCs) related to NodeStealer and other malware targeting its customers such as DuckTail or the recent malware posing as a ChatGPT-like app.
Please vote for Security Affairs (https://securityaffairs.com/) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections where is reported Securityaffairs or my name Pierluigi Paganini
Please nominate Security Affairs as your favorite blog.
Nominate Pierluigi Paganini and Security Affairs here here:
https://docs.google.com/forms/d/e/1FAIpQLSepvnj8b7QzMdLh7vWEDQDqohjBUsHyn3x3xRdYGCetwVy2DA/viewform
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Facebook)
