Inside the ChatGPT-era malware wave
Meta’s security team has published new findings on malware campaigns aimed at business accounts, with a focus on several custom-built families that abuse browser extensions, file-sharing services, and social media to hijack ad accounts. The report covers newly detected strains—including a JavaScript-based stealer dubbed NodeStealer—alongside fresh indicators for the long-running Ducktail operation. Since March 2023 alone, Meta says it has identified roughly ten malware families using ChatGPT and similar AI themes to compromise accounts across the internet.
How attackers are adapting to disruption
Malware operators are becoming more resilient to takedowns by spreading their infrastructure across multiple services. According to Meta’s analysis, attackers now routinely use social media platforms, ad networks, file-sharing hosts, link shorteners, and even niche creator-support sites like Buy Me a Coffee to distribute payloads or stage attacks. This multi-pronged approach means that a single platform’s enforcement action only removes one piece of the operation.
The Ducktail family, which has been active for several years and originates from Vietnam, illustrates this evolution. Meta says it has tracked and blocked successive Ducktail iterations that changed in response to industry enforcement. The malware is known to target LinkedIn for social engineering, browsers including Google Chrome, Microsoft Edge, Brave, and Firefox to steal session data, and file-hosting services such as Dropbox and Mega to serve malware.
In its latest form, Ducktail operators appear to have reacted to Meta’s around-the-clock session termination by automatically granting business admin permissions to attacker-requested ad actions. This speeds up their operations in an attempt to act before detection kicks in. Meta reports that its mitigations have kept pace with these changes and announced new product features aimed at making business accounts more resistant to such attacks. The company also issued a cease-and-desist letter to the individuals behind Ducktail in Vietnam and referred the matter to law enforcement.
AI-themed lures and cloaked links
Attackers are gravitating toward generative AI hype to bait victims. Over the past several months, Meta has investigated and acted against malware strains that pose as ChatGPT-based tools. These campaigns spread via Dropbox, Google Drive, Mega, MediaFire, Discord, Trello, Microsoft OneDrive, and iCloud, with the eventual goal of compromising businesses that manage ad accounts.
In one case, threat actors published malicious browser extensions in official web stores that claimed to offer ChatGPT features. Some of these extensions actually bundled working ChatGPT functionality alongside the malware, a tactic likely intended to evade store review. The extensions were promoted through social media and sponsored search results. Meta has blocked over 1,000 unique ChatGPT-themed malicious URLs across its platforms and shared those indicators with industry peers.
When blocked or publicly reported, these operators pivoted quickly. Cloaking techniques have been used to bypass automated ad review, and link shorteners mask the eventual destination of malicious URLs. Meta also observed campaigns switch their lures to Google’s Bard and TikTok marketing support, and move their payload hosting to smaller services once larger file-sharing platforms blocked them.
NodeStealer: a JavaScript stealer with a short lifespan
Toward the end of January 2023, Meta identified a new malware family it calls NodeStealer. Written in JavaScript and bundled with the Node.js runtime, NodeStealer targets Windows browsers to steal cookies, saved usernames, and passwords. Its focus includes Facebook, Gmail, and Outlook accounts, and Meta assesses the malware as originating from Vietnamese threat actors.
Meta says it detected NodeStealer within two weeks of deployment and moved to disrupt the operation. Takedown requests were submitted to third-party registrars, hosting providers, and application services, including Namecheap, which the attackers used to facilitate distribution. The disruption appears to have been effective: Meta reports it has observed no new NodeStealer samples since February 27, 2023, and continues to monitor for re-emergence.
Because so much malware operates outside any single platform’s reach, Meta recommends caution when installing browser extensions, mobile apps, or downloading files from the internet. The company’s defense-in-depth strategy spans malware analysis, targeted threat disruption, detection system updates, community support, threat-information sharing, and legal action against operators.
Inside NodeStealer’s Execution Flow
NodeStealer arrives disguised as a PDF or XLSX file, complete with matching icons and filenames that encourage victims to click. The ruse is effective because the file presents itself as a benign document rather than a potentially malicious executable.
Packaging and Disguise
At the time of discovery, one observed sample had only a single detection on VirusTotal. That low detection rate is likely due to the fact that the file is almost entirely composed of the Node.js runtime environment, with the malicious code itself representing only a small novel portion.
Although the file carries a .exe extension, its icon is a PDF. The file metadata further attempts to masquerade it as a product of “MicrosoftOffice.”
The malware is written in JavaScript, executed with Node.js, and compiled into a Windows binary using the pkg tool from the Node Package Manager (NPM). The observed sample is roughly 46 MB, with other variants ranging from 46 to 51 MB. The oversized file results from bundling the entire Node.js environment and all third-party dependencies. For reference, Node.js is an open-source, cross-platform JavaScript runtime commonly used for web applications, and pkg packages Node.js code into standalone executables for Linux, macOS, and Windows.
Persistence and Data Theft
Upon execution, NodeStealer first establishes persistence so it survives system reboots. It leverages the Node.js auto-launch module to create a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run\<current file name>, ensuring the malware runs again at startup.
The core objective is to steal stored passwords and session cookies from Chromium-based browsers: Chrome, Opera, Microsoft Edge, and Brave. The malware first locates files that store sensitive information such as cookies and saved credentials.
To decrypt the browser-protected data, the malware reads the encrypted_key from the “Local State” file, Base64 decodes it, and uses the win32crypt Node.js library to retrieve the decryption key.
Next, it reads the “Cookies” SQLite database and searches for a Facebook session cookie. If none is found, the malware halts further data extraction. When a session cookie exists, the malware proceeds to the “Login Data” SQLite database, which holds saved usernames and passwords, specifically targeting credentials for Facebook, Gmail, and Outlook. The reason for collecting email credentials is likely to compromise the victim’s primary contact point and gain access to other linked online accounts.
With the decryption key already extracted, the malware uses AES decryption to unlock the encrypted login data.
Advertising Account Reconnaissance
After obtaining Facebook credentials, NodeStealer makes unauthorized API requests from the victim’s machine to Facebook endpoints used by web and mobile apps. This activity is masked by the user’s real IP address, cookies, and system configuration, making it appear as normal legitimate traffic. The data collected is used to evaluate and ultimately take over advertising accounts to run unsanctioned ads, which significantly complicates detection.
Data Exfiltration and C2
The malware aggregates all stolen data into a JSON object, Base64 encodes it, and exfiltrates it to a hard-coded command-and-control (C2) server at hxxps://bot2q.advertiser-noreplysupport[.]dev. To evade defenses, it sends a GET request to hxxps://bot2q.advertiser-noreplysupport[.]dev/avatar.png, embedding the Base64 payload in the Authorization HTTP header.
Public registration data shows the C2 domain was created via Namecheap on December 27th, 2022. At the time of analysis, it resolved to the OVH VPS IP 15[.]235[.]187[.]170 and carried a DNS mail exchange (MX) record tied to Namecheap’s “Private Email” service. Server response headers indicated the C2 backend runs as a Node.js “Express” web application hosted by Nginx. Facebook reported the domain to Namecheap, and it ceased resolving as of January 25th, 2023.
