NodeStealerMalware
Last reported 18 days ago, by The Hacker News3 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1036Masquerading
“The end goal is to deploy a custom backdoor called CosmicPulse by setting up scheduled tasks using RedFlick through phishing emails masquerading as invitations.”
- T1053.005Scheduled Task
“The end goal is to deploy a custom backdoor called CosmicPulse by setting up scheduled tasks using RedFlick through phishing emails masquerading as invitations.”
- T1056.001Keylogging
“"The latest Python NodeStealer variant incorporates new spyware features, including keylogging, clipboard monitoring, and screenshot capture," Netskope said.”
- T1505.003Web Shell
“…026-82078 and CVE-2026-81578, two PaperCut MF vulnerabilities, as zero-days to load an in-memory Java loader, which in turn deployed a web shell.”
- T1684Social Engineering
“"It abused trusted platforms, attacker-authored content, paid search, and social engineering to move people toward malware delivery."”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes“According to a report published by Mimecast in July 2026, malware families like VietCredCare, DuckTail, NodeStealer, and PXA Stealer have engendered ad account theft at scale, leading to a "widespread commodity crime in the advertising ecosystem" where bad actors drain business b…”
-
⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests“New Variant of NodeStealer Emerges — Netskope Threat Labs said it detected a new variant of NodeStealer packing major updates that turn it into a full-blown spyware.”
-
Risky Bulletin: BEC campaign steals €35 million from French notaries“NodeStealer: The developers of the NodeStealer malware appear to have used an AI coding assistant to expand their infostealer into a full blown spyware.”
Indicators in its reports
named in the reports above- collusion[.]wikiin 1 report
- apply.fbijobs[.]govin 1 report
- hneumannmep.bsky[.]socialin 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.