{"id":53538,"date":"2023-09-05T00:00:00","date_gmt":"2023-09-05T00:00:00","guid":{"rendered":"urn:uuid:2295f63d-e2ac-348d-f02c-83aa087e3b6c"},"modified":"2023-09-05T00:00:00","modified_gmt":"2023-09-05T00:00:00","slug":"analyzing-a-facebook-profile-stealer-written-in-node-js","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/analyzing-a-facebook-profile-stealer-written-in-node-js\/","title":{"rendered":"Analyzing a Facebook Profile Stealer Written in Node.js"},"content":{"rendered":"

<\/p>\n

<\/div>\n

After the stealing process is completed, the client sends another status message to the server stating that the stealing process has been completed. In the case of a server pushing a message during the stealing process, the client responds with a \u201cwait for the completion\u201d message.<\/p>\n

The reason for the implementation of handling such messages is the activation of the stealing process. The threat actor maintains an IP address list of infected clients that are just waiting for activation (by receiving a message). After the threat actor pushes a message to the clients, the stealing process restarts.<\/p>\n

<\/span><\/h2>\n

The stealer focuses on the following web browsers:<\/p>\n