www.netskope.com
Open in
urlscan Pro
141.193.213.21
Public Scan
URL:
https://www.netskope.com/blog/new-python-nodestealer-goes-beyond-facebook-credentials-now-stealing-all-browser-cookies-an...
Submission: On December 28 via api from BY — Scanned from CA
Submission: On December 28 via api from BY — Scanned from CA
Form analysis 10 forms found in the DOM
<form>
<fieldset>
<legend class="visuallyhidden">Consent Selection</legend>
<div id="CybotCookiebotDialogBodyFieldsetInnerContainer">
<div class="CybotCookiebotDialogBodyLevelButtonWrapper"><label class="CybotCookiebotDialogBodyLevelButtonLabel" for="CybotCookiebotDialogBodyLevelButtonNecessary"><strong
class="CybotCookiebotDialogBodyLevelButtonDescription">Necessary</strong></label>
<div class="CybotCookiebotDialogBodyLevelButtonSliderWrapper CybotCookiebotDialogBodyLevelButtonSliderWrapperDisabled"><input type="checkbox" id="CybotCookiebotDialogBodyLevelButtonNecessary"
class="CybotCookiebotDialogBodyLevelButton CybotCookiebotDialogBodyLevelButtonDisabled" disabled="disabled" checked="checked"> <span class="CybotCookiebotDialogBodyLevelButtonSlider"></span></div>
</div>
<div class="CybotCookiebotDialogBodyLevelButtonWrapper"><label class="CybotCookiebotDialogBodyLevelButtonLabel" for="CybotCookiebotDialogBodyLevelButtonPreferences"><strong
class="CybotCookiebotDialogBodyLevelButtonDescription">Preferences</strong></label>
<div class="CybotCookiebotDialogBodyLevelButtonSliderWrapper"><input type="checkbox" id="CybotCookiebotDialogBodyLevelButtonPreferences" class="CybotCookiebotDialogBodyLevelButton CybotCookiebotDialogBodyLevelConsentCheckbox"
data-target="CybotCookiebotDialogBodyLevelButtonPreferencesInline" checked="checked" tabindex="0"> <span class="CybotCookiebotDialogBodyLevelButtonSlider"></span></div>
</div>
<div class="CybotCookiebotDialogBodyLevelButtonWrapper"><label class="CybotCookiebotDialogBodyLevelButtonLabel" for="CybotCookiebotDialogBodyLevelButtonStatistics"><strong
class="CybotCookiebotDialogBodyLevelButtonDescription">Statistics</strong></label>
<div class="CybotCookiebotDialogBodyLevelButtonSliderWrapper"><input type="checkbox" id="CybotCookiebotDialogBodyLevelButtonStatistics" class="CybotCookiebotDialogBodyLevelButton CybotCookiebotDialogBodyLevelConsentCheckbox"
data-target="CybotCookiebotDialogBodyLevelButtonStatisticsInline" checked="checked" tabindex="0"> <span class="CybotCookiebotDialogBodyLevelButtonSlider"></span></div>
</div>
<div class="CybotCookiebotDialogBodyLevelButtonWrapper"><label class="CybotCookiebotDialogBodyLevelButtonLabel" for="CybotCookiebotDialogBodyLevelButtonMarketing"><strong
class="CybotCookiebotDialogBodyLevelButtonDescription">Marketing</strong></label>
<div class="CybotCookiebotDialogBodyLevelButtonSliderWrapper"><input type="checkbox" id="CybotCookiebotDialogBodyLevelButtonMarketing" class="CybotCookiebotDialogBodyLevelButton CybotCookiebotDialogBodyLevelConsentCheckbox"
data-target="CybotCookiebotDialogBodyLevelButtonMarketingInline" checked="checked" tabindex="0"> <span class="CybotCookiebotDialogBodyLevelButtonSlider"></span></div>
</div>
</div>
</fieldset>
</form><form><input type="checkbox" id="CybotCookiebotDialogBodyLevelButtonNecessaryInline" class="CybotCookiebotDialogBodyLevelButton CybotCookiebotDialogBodyLevelButtonDisabled" disabled="disabled" checked="checked"> <span
class="CybotCookiebotDialogBodyLevelButtonSlider"></span></form><form><input type="checkbox" id="CybotCookiebotDialogBodyLevelButtonPreferencesInline" class="CybotCookiebotDialogBodyLevelButton CybotCookiebotDialogBodyLevelConsentCheckbox" data-target="CybotCookiebotDialogBodyLevelButtonPreferences"
checked="checked" tabindex="0"> <span class="CybotCookiebotDialogBodyLevelButtonSlider"></span></form><form><input type="checkbox" id="CybotCookiebotDialogBodyLevelButtonStatisticsInline" class="CybotCookiebotDialogBodyLevelButton CybotCookiebotDialogBodyLevelConsentCheckbox" data-target="CybotCookiebotDialogBodyLevelButtonStatistics"
checked="checked" tabindex="0"> <span class="CybotCookiebotDialogBodyLevelButtonSlider"></span></form><form><input type="checkbox" id="CybotCookiebotDialogBodyLevelButtonMarketingInline" class="CybotCookiebotDialogBodyLevelButton CybotCookiebotDialogBodyLevelConsentCheckbox" data-target="CybotCookiebotDialogBodyLevelButtonMarketing" checked="checked"
tabindex="0"> <span class="CybotCookiebotDialogBodyLevelButtonSlider"></span></form><form class="CybotCookiebotDialogBodyLevelButtonSliderWrapper"><input type="checkbox" id="CybotCookiebotDialogBodyContentCheckboxPersonalInformation" class="CybotCookiebotDialogBodyLevelButton"> <span
class="CybotCookiebotDialogBodyLevelButtonSlider"></span></form>GET /
<form role="search" method="GET" id="searchform" action="/"> <input name="s" type="text" class=" header__search-input header__search-input--mobile aa-input" id="header__search-input--mobile" placeholder="Search netskope.com" autocomplete="off"
spellcheck="false" role="combobox" aria-autocomplete="list" aria-expanded="false" aria-owns="algolia-autocomplete-listbox-0" dir="auto" style="">
<pre aria-hidden="true"
style="position: absolute; visibility: hidden; white-space: pre; font-family: Graphik; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; word-spacing: 0px; letter-spacing: normal; text-indent: 0px; text-rendering: auto; text-transform: none;"></pre>
</form>GET /
<form role="search" method="GET" id="searchform" action="/"> <input name="s" type="text" class="header__search-input aa-input" id="header__search-input" placeholder="Search netskope.com" autocomplete="off" spellcheck="false" role="combobox"
aria-autocomplete="list" aria-expanded="false" aria-owns="algolia-autocomplete-listbox-2" dir="auto" style="">
<pre aria-hidden="true"
style="position: absolute; visibility: hidden; white-space: pre; font-family: Graphik; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; word-spacing: 0px; letter-spacing: normal; text-indent: 0px; text-rendering: auto; text-transform: none;"></pre>
</form><form id="mktoForm_1953" novalidate="novalidate" class="mktoForm mktoHasWidth mktoLayoutAbove" style="font-family: Helvetica, Arial, sans-serif; font-size: 13px; color: rgb(51, 51, 51); width: 431px;">
<style type="text/css">
.mktoForm .mktoButtonWrap.mktoSimple .mktoButton {
color: #fff;
border: 1px solid #75ae4c;
padding: 0.4em 1em;
font-size: 1em;
background-color: #99c47c;
background-image: -webkit-gradient(linear, left top, left bottom, from(#99c47c), to(#75ae4c));
background-image: -webkit-linear-gradient(top, #99c47c, #75ae4c);
background-image: -moz-linear-gradient(top, #99c47c, #75ae4c);
background-image: linear-gradient(to bottom, #99c47c, #75ae4c);
}
.mktoForm .mktoButtonWrap.mktoSimple .mktoButton:hover {
border: 1px solid #447f19;
}
.mktoForm .mktoButtonWrap.mktoSimple .mktoButton:focus {
outline: none;
border: 1px solid #447f19;
}
.mktoForm .mktoButtonWrap.mktoSimple .mktoButton:active {
background-color: #75ae4c;
background-image: -webkit-gradient(linear, left top, left bottom, from(#75ae4c), to(#99c47c));
background-image: -webkit-linear-gradient(top, #75ae4c, #99c47c);
background-image: -moz-linear-gradient(top, #75ae4c, #99c47c);
background-image: linear-gradient(to bottom, #75ae4c, #99c47c);
}
</style>
<div class="mktoFormRow">
<div class="mktoFormCol" style="margin-bottom: 10px;">
<div class="mktoOffset mktoHasWidth" style="width: 10px;"></div>
<div class="mktoFieldWrap">
<div class="mktoHtmlText mktoHasWidth" style="width: 260px;"><span style="font-family: arial, helvetica, sans-serif; font-size: 16px;"><strong><span style="color: #ffffff;">What topics would you like to subscribe to?</span></strong></span>
</div>
<div class="mktoClear"></div>
</div>
<div class="mktoClear"></div>
</div>
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow">
<div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 10px;">
<div class="mktoOffset" style="width: 10px;"></div>
<div class="mktoFieldWrap"><label for="blogTopics" id="LblblogTopics" class="mktoLabel mktoHasWidth" style="width: 100px;">
<div class="mktoAsterix">*</div>Blog Topics:
</label>
<div class="mktoGutter mktoHasWidth" style="width: 10px;"></div>
<div class="mktoLogicalField mktoCheckboxList mktoHasWidth" style="width: 150px;"><input name="blogTopics" id="mktoCheckbox_147818_0" type="checkbox" value="Netskope Platform & Thought Leadership"
aria-labelledby="LblblogTopics LblmktoCheckbox_147818_0 InstructblogTopics" class="mktoField"><label for="mktoCheckbox_147818_0" id="LblmktoCheckbox_147818_0">Netskope Platform & Thought Leadership</label><input name="blogTopics"
id="mktoCheckbox_147818_1" type="checkbox" value="AI" aria-labelledby="LblblogTopics LblmktoCheckbox_147818_1 InstructblogTopics" class="mktoField"><label for="mktoCheckbox_147818_1" id="LblmktoCheckbox_147818_1">AI</label><input
name="blogTopics" id="mktoCheckbox_147818_2" type="checkbox" value="Threat Labs" aria-labelledby="LblblogTopics LblmktoCheckbox_147818_2 InstructblogTopics" class="mktoField"><label for="mktoCheckbox_147818_2"
id="LblmktoCheckbox_147818_2">Threat Labs</label></div><span id="InstructblogTopics" tabindex="-1" class="mktoInstruction"></span>
<div class="mktoClear"></div>
</div>
<div class="mktoClear"></div>
</div>
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow">
<div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 10px;">
<div class="mktoOffset" style="width: 10px;"></div>
<div class="mktoFieldWrap mktoRequiredField"><label for="Email" id="LblEmail" class="mktoLabel mktoHasWidth" style="width: 100px;">
<div class="mktoAsterix">*</div>
</label>
<div class="mktoGutter mktoHasWidth" style="width: 10px;"></div><input id="Email" name="Email" placeholder="Business Email" maxlength="255" aria-labelledby="LblEmail InstructEmail" type="email"
class="mktoField mktoEmailField mktoHasWidth mktoRequired" aria-required="true" style="width: 150px;"><span id="InstructEmail" tabindex="-1" class="mktoInstruction"></span>
<div class="mktoClear"></div>
</div>
<div class="mktoClear"></div>
</div>
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow">
<div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 10px;">
<div class="mktoOffset" style="width: 10px;"></div>
<div class="mktoFieldWrap mktoRequiredField"><label for="Country" id="LblCountry" class="mktoLabel mktoHasWidth" style="width: 100px;">
<div class="mktoAsterix">*</div>Country:
</label>
<div class="mktoGutter mktoHasWidth" style="width: 10px;"></div><select id="Country" name="Country" aria-labelledby="LblCountry InstructCountry" class="mktoField mktoHasWidth mktoRequired" aria-required="true" style="width: 150px;">
<option value="">Select Country...</option>
<option value="United States">United States</option>
<option value="----------------------------------">----------------------------------</option>
<option value="Afghanistan">Afghanistan</option>
<option value="Albania">Albania</option>
<option value="Algeria">Algeria</option>
<option value="American Samoa">American Samoa</option>
<option value="Andorra">Andorra</option>
<option value="Angola">Angola</option>
<option value="Antigua and Barbuda">Antigua and Barbuda</option>
<option value="Argentina">Argentina</option>
<option value="Armenia">Armenia</option>
<option value="Australia">Australia</option>
<option value="Austria">Austria</option>
<option value="Azerbaijan">Azerbaijan</option>
<option value="Bahamas">Bahamas</option>
<option value="Bahrain">Bahrain</option>
<option value="Bangladesh">Bangladesh</option>
<option value="Barbados">Barbados</option>
<option value="Belarus">Belarus</option>
<option value="Belgium">Belgium</option>
<option value="Belize">Belize</option>
<option value="Benin">Benin</option>
<option value="Bermuda">Bermuda</option>
<option value="Bhutan">Bhutan</option>
<option value="Bolivia">Bolivia</option>
<option value="Bosnia and Herzegovina">Bosnia and Herzegovina</option>
<option value="Botswana">Botswana</option>
<option value="Brazil">Brazil</option>
<option value="Brunei">Brunei</option>
<option value="Bulgaria">Bulgaria</option>
<option value="Burkina Faso">Burkina Faso</option>
<option value="Burundi">Burundi</option>
<option value="Cambodia">Cambodia</option>
<option value="Cameroon">Cameroon</option>
<option value="Canada">Canada</option>
<option value="Cape Verde">Cape Verde</option>
<option value="Cayman Islands">Cayman Islands</option>
<option value="Central African Republic">Central African Republic</option>
<option value="Chad">Chad</option>
<option value="Chile">Chile</option>
<option value="China">China</option>
<option value="Colombia">Colombia</option>
<option value="Comoros">Comoros</option>
<option value="Congo, Democratic Republic of the">Congo, Democratic Republic of the</option>
<option value="Congo, Republic of the">Congo, Republic of the</option>
<option value="Costa Rica">Costa Rica</option>
<option value="Côte d'Ivoire">Côte d'Ivoire</option>
<option value="Croatia">Croatia</option>
<option value="Cuba">Cuba</option>
<option value="Cyprus">Cyprus</option>
<option value="Czech Republic">Czech Republic</option>
<option value="Denmark">Denmark</option>
<option value="Djibouti">Djibouti</option>
<option value="Dominica">Dominica</option>
<option value="Dominican Republic">Dominican Republic</option>
<option value="East Timor">East Timor</option>
<option value="Ecuador">Ecuador</option>
<option value="Egypt">Egypt</option>
<option value="El Salvador">El Salvador</option>
<option value="Equatorial Guinea">Equatorial Guinea</option>
<option value="Eritrea">Eritrea</option>
<option value="Estonia">Estonia</option>
<option value="Ethiopia">Ethiopia</option>
<option value="Fiji">Fiji</option>
<option value="Finland">Finland</option>
<option value="France">France</option>
<option value="French Polynesia">French Polynesia</option>
<option value="Gabon">Gabon</option>
<option value="Gambia">Gambia</option>
<option value="Georgia">Georgia</option>
<option value="Germany">Germany</option>
<option value="Ghana">Ghana</option>
<option value="Greece">Greece</option>
<option value="Greenland">Greenland</option>
<option value="Grenada">Grenada</option>
<option value="Guam">Guam</option>
<option value="Guatemala">Guatemala</option>
<option value="Guinea">Guinea</option>
<option value="Guinea-Bissau">Guinea-Bissau</option>
<option value="Guyana">Guyana</option>
<option value="Haiti">Haiti</option>
<option value="Honduras">Honduras</option>
<option value="Hong Kong">Hong Kong</option>
<option value="Hungary">Hungary</option>
<option value="Iceland">Iceland</option>
<option value="India">India</option>
<option value="Indonesia">Indonesia</option>
<option value="Iran">Iran</option>
<option value="Iraq">Iraq</option>
<option value="Ireland">Ireland</option>
<option value="Israel">Israel</option>
<option value="Italy">Italy</option>
<option value="Jamaica">Jamaica</option>
<option value="Japan">Japan</option>
<option value="Jordan">Jordan</option>
<option value="Kazakhstan">Kazakhstan</option>
<option value="Kenya">Kenya</option>
<option value="Kiribati">Kiribati</option>
<option value="North Korea">North Korea</option>
<option value="South Korea">South Korea</option>
<option value="Kosovo">Kosovo</option>
<option value="Kuwait">Kuwait</option>
<option value="Kyrgyzstan">Kyrgyzstan</option>
<option value="Laos">Laos</option>
<option value="Latvia">Latvia</option>
<option value="Lebanon">Lebanon</option>
<option value="Lesotho">Lesotho</option>
<option value="Liberia">Liberia</option>
<option value="Libya">Libya</option>
<option value="Liechtenstein">Liechtenstein</option>
<option value="Lithuania">Lithuania</option>
<option value="Luxembourg">Luxembourg</option>
<option value="Macedonia">Macedonia</option>
<option value="Madagascar">Madagascar</option>
<option value="Malawi">Malawi</option>
<option value="Malaysia">Malaysia</option>
<option value="Maldives">Maldives</option>
<option value="Mali">Mali</option>
<option value="Malta">Malta</option>
<option value="Marshall Islands">Marshall Islands</option>
<option value="Mauritania">Mauritania</option>
<option value="Mauritius">Mauritius</option>
<option value="Mexico">Mexico</option>
<option value="Micronesia">Micronesia</option>
<option value="Moldova">Moldova</option>
<option value="Monaco">Monaco</option>
<option value="Mongolia">Mongolia</option>
<option value="Montenegro">Montenegro</option>
<option value="Morocco">Morocco</option>
<option value="Mozambique">Mozambique</option>
<option value="Myanmar">Myanmar</option>
<option value="Namibia">Namibia</option>
<option value="Nauru">Nauru</option>
<option value="Nepal">Nepal</option>
<option value="Netherlands">Netherlands</option>
<option value="New Zealand">New Zealand</option>
<option value="Nicaragua">Nicaragua</option>
<option value="Niger">Niger</option>
<option value="Nigeria">Nigeria</option>
<option value="Norway">Norway</option>
<option value="Northern Mariana Islands">Northern Mariana Islands</option>
<option value="Oman">Oman</option>
<option value="Pakistan">Pakistan</option>
<option value="Palau">Palau</option>
<option value="Palestine">Palestine</option>
<option value="Panama">Panama</option>
<option value="Papua New Guinea">Papua New Guinea</option>
<option value="Paraguay">Paraguay</option>
<option value="Peru">Peru</option>
<option value="Philippines">Philippines</option>
<option value="Poland">Poland</option>
<option value="Portugal">Portugal</option>
<option value="Puerto Rico">Puerto Rico</option>
<option value="Qatar">Qatar</option>
<option value="Romania">Romania</option>
<option value="Russia">Russia</option>
<option value="Rwanda">Rwanda</option>
<option value="Saint Kitts and Nevis">Saint Kitts and Nevis</option>
<option value="Saint Lucia">Saint Lucia</option>
<option value="Saint Vincent and the Grenadines">Saint Vincent and the Grenadines</option>
<option value="Samoa">Samoa</option>
<option value="San Marino">San Marino</option>
<option value="Sao Tome and Principe">Sao Tome and Principe</option>
<option value="Saudi Arabia">Saudi Arabia</option>
<option value="Senegal">Senegal</option>
<option value="Serbia and Montenegro">Serbia and Montenegro</option>
<option value="Seychelles">Seychelles</option>
<option value="Sierra Leone">Sierra Leone</option>
<option value="Singapore">Singapore</option>
<option value="Slovakia">Slovakia</option>
<option value="Slovenia">Slovenia</option>
<option value="Solomon Islands">Solomon Islands</option>
<option value="Somalia">Somalia</option>
<option value="South Africa">South Africa</option>
<option value="Spain">Spain</option>
<option value="Sri Lanka">Sri Lanka</option>
<option value="Sudan">Sudan</option>
<option value="Sudan, South">Sudan, South</option>
<option value="Suriname">Suriname</option>
<option value="Swaziland">Swaziland</option>
<option value="Sweden">Sweden</option>
<option value="Switzerland">Switzerland</option>
<option value="Syria">Syria</option>
<option value="Taiwan">Taiwan</option>
<option value="Tajikistan">Tajikistan</option>
<option value="Tanzania">Tanzania</option>
<option value="Thailand">Thailand</option>
<option value="Togo">Togo</option>
<option value="Tonga">Tonga</option>
<option value="Trinidad and Tobago">Trinidad and Tobago</option>
<option value="Tunisia">Tunisia</option>
<option value="Turkey">Turkey</option>
<option value="Turkmenistan">Turkmenistan</option>
<option value="Tuvalu">Tuvalu</option>
<option value="Uganda">Uganda</option>
<option value="Ukraine">Ukraine</option>
<option value="United Arab Emirates">United Arab Emirates</option>
<option value="United Kingdom">United Kingdom</option>
<option value="United States">United States</option>
<option value="Uruguay">Uruguay</option>
<option value="Uzbekistan">Uzbekistan</option>
<option value="Vanuatu">Vanuatu</option>
<option value="Vatican City">Vatican City</option>
<option value="Venezuela">Venezuela</option>
<option value="Vietnam">Vietnam</option>
<option value="Virgin Islands, British">Virgin Islands, British</option>
<option value="Virgin Islands, U.S.">Virgin Islands, U.S.</option>
<option value="Yemen">Yemen</option>
<option value="Zambia">Zambia</option>
<option value="Zimbabwe">Zimbabwe</option>
</select><span id="InstructCountry" tabindex="-1" class="mktoInstruction"></span>
<div class="mktoClear"></div>
</div>
<div class="mktoClear"></div>
</div>
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow">
<div class="mktoPlaceholder mktoPlaceholderPostalCode"></div>
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow">
<div class="mktoPlaceholder mktoPlaceholderConsent_to_Processing__c"></div>
<div class="mktoPlaceholder mktoPlaceholderHtmlText_2022-09-14T22 891Z"></div>
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow"><input type="hidden" name="LeadSource" class="mktoField mktoFieldDescriptor mktoFormCol" value="Website: Organic" style="margin-bottom: 10px;">
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow"><input type="hidden" name="Lead_Source_Description__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="Blog subscription" style="margin-bottom: 10px;">
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow"><input type="hidden" name="Last_SFDC_Campaign_ID__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 10px;">
<div class="mktoClear"></div>
</div>
<div class="mktoFormRow"><input type="hidden" name="Partner_Lead_Source__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 10px;">
<div class="mktoClear"></div>
</div>
<div class="mktoButtonRow"><span class="mktoButtonWrap mktoSimple" style="margin-left: 120px;"><button type="submit" class="mktoButton g-recaptcha" data-sitekey="6LfsX8IUAAAAAMx93LpqbR7iUHXa4HZukOv8CS2S"
data-callback="run_form_submit">Subscribe</button></span></div><input type="hidden" name="formid" class="mktoField mktoFieldDescriptor" value="1953"><input type="hidden" name="munchkinId" class="mktoField mktoFieldDescriptor"
value="665-KFP-612"><input type="hidden" name="utm_source__c" class="mktoField mktoFieldDescriptor" value=""><input type="hidden" name="utm_agn__c" class="mktoField mktoFieldDescriptor" value=""><input type="hidden" name="utm_content__c"
class="mktoField mktoFieldDescriptor" value=""><input type="hidden" name="utm_medium__c" class="mktoField mktoFieldDescriptor" value=""><input type="hidden" name="utm_audience__c" class="mktoField mktoFieldDescriptor" value=""><input
type="hidden" name="utm_campaign__c" class="mktoField mktoFieldDescriptor" value=""><input type="hidden" name="utm_term__c" class="mktoField mktoFieldDescriptor" value=""><input type="hidden" name="gclid__c" class="mktoField mktoFieldDescriptor"
value=""><input type="hidden" name="lastFormURL" class="mktoField mktoFieldDescriptor" value="https://www.netskope.com/blog/new-python-nodestealer-goes-beyond-facebook-credentials-now-stealing-all-browser-cookies-and-login-credentials">
</form><form novalidate="novalidate" class="mktoForm mktoHasWidth mktoLayoutAbove"
style="font-family: Helvetica, Arial, sans-serif; font-size: 13px; color: rgb(51, 51, 51); visibility: hidden; position: absolute; top: -500px; left: -1000px; width: 1600px;"></form>Text Content
* Consent
* Details
* [#IABV2SETTINGS#]
* About
THIS WEBSITE USES COOKIES
This website uses cookies for advertising and analytics purposes as described in
our Cookies Policy. For more information on how you can contact us and how we
process personal data please see our Privacy Policy.
Consent Selection
Necessary
Preferences
Statistics
Marketing
Show details
* Necessary 36
Necessary cookies help make a website usable by enabling basic functions like
page navigation and access to secure areas of the website. The website cannot
function properly without these cookies.
* Beeswax
1
Learn more about this provider
checkForPermissionDetermines whether the user has accepted the cookie
consent box.
Maximum Storage Duration: 1 dayType: HTTP Cookie
* Cookiebot
5
Learn more about this provider
CookieConsent [x4]Stores the user's cookie consent state for the current
domain
Maximum Storage Duration: 1 yearType: HTTP Cookie
1.gifUsed to count the number of sessions to the website, necessary for
optimizing CMP product delivery.
Maximum Storage Duration: SessionType: Pixel Tracker
* CrazyEgg
3
Learn more about this provider
_ce.cch [x2]Stores the user's cookie consent state for the current domain
Maximum Storage Duration: SessionType: HTTP Cookie
ce_asset_waitingThis cookie is part of a bundle of cookies which serve the
purpose of content delivery and presentation. The cookies keep the correct
state of font, blog/picture sliders, color themes and other website
settings.
Maximum Storage Duration: SessionType: HTML Local Storage
* Google
4
Learn more about this provider
Some of the data collected by this provider is for the purposes of
personalization and measuring advertising effectiveness.
ar_debugChecks whether a technical debugger-cookie is present.
Maximum Storage Duration: 30 daysType: HTTP Cookie
test_cookieUsed to check if the user's browser supports cookies.
Maximum Storage Duration: 1 dayType: HTTP Cookie
rc::aThis cookie is used to distinguish between humans and bots. This is
beneficial for the website, in order to make valid reports on the use of
their website.
Maximum Storage Duration: PersistentType: HTML Local Storage
rc::cThis cookie is used to distinguish between humans and bots.
Maximum Storage Duration: SessionType: HTML Local Storage
* LinkedIn
1
Learn more about this provider
li_gcStores the user's cookie consent state for the current domain
Maximum Storage Duration: 180 daysType: HTTP Cookie
* YouTube
1
Learn more about this provider
CONSENTUsed to detect if the visitor has accepted the marketing category
in the cookie banner. This cookie is necessary for GDPR-compliance of the
website.
Maximum Storage Duration: 2 yearsType: HTTP Cookie
* app-sj09.marketo.com
de-fd0f28693ae9900c1.getsmartling.com
es-es-fd0f286935d441d43.getsmartling.com
fr-fd0f286935c01d491.getsmartling.com
go.netskope.com
ja-fd0f286931ce0bc24.getsmartling.com
pt-fd0f28693e33ccf6f.getsmartling.com
7
BIGipServer# [x7]Used to distribute traffic to the website on several
servers in order to optimise response times.
Maximum Storage Duration: SessionType: HTTP Cookie
* app-sj09.marketo.com
go.netskope.com
js.ubembed.com
t.co
unbouncepages.com
uploads-ssl.webflow.com
zoominfo.com
7
__cf_bm [x7]This cookie is used to distinguish between humans and bots.
This is beneficial for the website, in order to make valid reports on the
use of their website.
Maximum Storage Duration: 1 dayType: HTTP Cookie
* netskopestage.wpengine.com
www.netskope.com
2
testcookie [x2]This cookie determines whether the browser accepts cookies.
Maximum Storage Duration: SessionType: HTTP Cookie
* script.crazyegg.com
www.netskope.com
2
ce_successful_csp_check [x2]Detects whether user behaviour tracking should
be active on the website.
Maximum Storage Duration: PersistentType: HTML Local Storage
* ws.zoominfo.com
1
visitorIdPreserves users states across page requests.
Maximum Storage Duration: 1 yearType: HTTP Cookie
* www.netskope.com
zoominfo.com
2
_cfuvid [x2]This cookie is a part of the services provided by Cloudflare -
Including load-balancing, deliverance of website content and serving DNS
connection for website operators.
Maximum Storage Duration: SessionType: HTTP Cookie
* Preferences 4
Preference cookies enable a website to remember information that changes the
way the website behaves or looks, like your preferred language or the region
that you are in.
* Cookiebot
1
Learn more about this provider
CookieConsentBulkSetting-#Enables cookie consent across multiple websites
Maximum Storage Duration: PersistentType: HTML Local Storage
* LinkedIn
1
Learn more about this provider
lidcRegisters which server-cluster is serving the visitor. This is used in
context with load balancing, in order to optimize user experience.
Maximum Storage Duration: 1 dayType: HTTP Cookie
* netskopestage.wpengine.com
www.netskope.com
2
wistia-video-progress-# [x2]Contains a timestamp for the website’s
video-content. This allows the user to resume watching without having to
start over, if the user leaves the video or website.
Maximum Storage Duration: PersistentType: HTML Local Storage
* Statistics 39
Statistic cookies help website owners to understand how visitors interact
with websites by collecting and reporting information anonymously.
* Appnexus
1
Learn more about this provider
bounceDetermines if a user leaves the website straight away. This
information is used for internal statistics and analytics by the website
operator.
Maximum Storage Duration: SessionType: Pixel Tracker
* CrazyEgg
7
Learn more about this provider
_ce.clock_dataCollects data on the user’s navigation and behavior on the
website. This is used to compile statistical reports and heatmaps for the
website owner.
Maximum Storage Duration: 1 dayType: HTTP Cookie
_ce.gtld [x2]Holds which URL should be presented to the visitor when
visiting the site.
Maximum Storage Duration: SessionType: HTTP Cookie
_ce.sCollects data on the user’s navigation and behavior on the website.
This is used to compile statistical reports and heatmaps for the website
owner.
Maximum Storage Duration: 1 yearType: HTTP Cookie
cebsTracks the individual sessions on the website, allowing the website to
compile statistical data from multiple visits. This data can also be used
to create leads for marketing purposes.
Maximum Storage Duration: SessionType: HTTP Cookie
cebsp_Collects data on the user’s navigation and behavior on the website.
This is used to compile statistical reports and heatmaps for the website
owner.
Maximum Storage Duration: SessionType: HTTP Cookie
cetabidSets a unique ID for the session. This allows the website to obtain
data on visitor behaviour for statistical purposes.
Maximum Storage Duration: SessionType: HTML Local Storage
* Google
11
Learn more about this provider
Some of the data collected by this provider is for the purposes of
personalization and measuring advertising effectiveness.
collectUsed to send data to Google Analytics about the visitor's device
and behavior. Tracks the visitor across devices and marketing channels.
Maximum Storage Duration: SessionType: Pixel Tracker
_dc_gtm_UA-# [x2]Used by Google Tag Manager to control the loading of a
Google Analytics script tag.
Maximum Storage Duration: SessionType: HTTP Cookie
_ga [x2]Registers a unique ID that is used to generate statistical data on
how the visitor uses the website.
Maximum Storage Duration: 401 daysType: HTTP Cookie
_ga_# [x2]Used by Google Analytics to collect data on the number of times
a user has visited the website as well as dates for the first and most
recent visit.
Maximum Storage Duration: 401 daysType: HTTP Cookie
_gat [x2]Used by Google Analytics to throttle request rate
Maximum Storage Duration: 1 dayType: HTTP Cookie
_gid [x2]Registers a unique ID that is used to generate statistical data
on how the visitor uses the website.
Maximum Storage Duration: 2 daysType: HTTP Cookie
* LinkedIn
2
Learn more about this provider
AnalyticsSyncHistoryUsed in connection with data-synchronization with
third-party analysis service.
Maximum Storage Duration: 1 monthType: HTTP Cookie
ln_orRegisters statistical data on users' behaviour on the website. Used
for internal analytics by the website operator.
Maximum Storage Duration: 2 daysType: HTTP Cookie
* Netskope
4
Learn more about this provider
ziwsSessionCollects statistics on the user's visits to the website, such
as the number of visits, average time spent on the website and what pages
have been read.
Maximum Storage Duration: SessionType: HTML Local Storage
ubvtCollects data on the user's visits to the website, such as the number
of visits, average time spent on the website and what pages have been
loaded with the purpose of generating reports for optimising the website
content.
Maximum Storage Duration: 3 daysType: HTTP Cookie
ubpvDetermines if a user leaves the website straight away. This
information is used for internal statistics and analytics by the website
operator.
Maximum Storage Duration: 6 monthsType: HTTP Cookie
ubvsCollects data on the user's visits to the website, such as the number
of visits, average time spent on the website and what pages have been
loaded with the purpose of generating reports for optimising the website
content.
Maximum Storage Duration: 180 daysType: HTTP Cookie
* Twitter Inc.
1
Learn more about this provider
personalization_idThis cookie is set by Twitter - The cookie allows the
visitor to share content from the website onto their Twitter profile.
Maximum Storage Duration: 400 daysType: HTTP Cookie
* a1896f6cbba2421d9f2d046f95d72468.js.ubembed.com
2
ub-emb-GUID#Pending
Maximum Storage Duration: PersistentType: HTML Local Storage
ub-emb-idEnables the website to make variations of their landing-page.
This is used to minimize bounce-rates, which means that fewer users leave
the page immediately.
Maximum Storage Duration: PersistentType: HTML Local Storage
* cdn.cr-relay.com
1
cookiecookieThis cookie is used by the website’s operator in context with
multi-variate testing. This is a tool used to combine or change content on
the website. This allows the website to find the best variation/edition of
the site.
Maximum Storage Duration: SessionType: HTTP Cookie
* js.qualified.com
2
__q_domainTest [x2]Used in context with Account-Based-Marketing (ABM). The
cookie registers data such as IP-addresses, time spent on the website and
page requests for the visit. This is used for retargeting of multiple
users rooting from the same IP-addresses. ABM usually facilitates B2B
marketing purposes.
Maximum Storage Duration: SessionType: HTTP Cookie
* netskopestage.wpengine.com
www.netskope.com
2
wistia [x2]Used by the website to track the visitor's use of video-content
- The cookie roots from Wistia, which provides video-software to websites.
Maximum Storage Duration: PersistentType: HTML Local Storage
* script.crazyegg.com
www.netskope.com
4
ce_fvd [x2]Collects data on the user’s navigation and behavior on the
website. This is used to compile statistical reports and heatmaps for the
website owner.
Maximum Storage Duration: PersistentType: HTML Local Storage
ce_virtual_tracker_data [x2]Collects data on the user’s navigation and
behavior on the website. This is used to compile statistical reports and
heatmaps for the website owner.
Maximum Storage Duration: PersistentType: HTML Local Storage
* www.netskope.com
ws.zoominfo.com
2
ziwsSessionId [x2]Collects statistics on the user's visits to the website,
such as the number of visits, average time spent on the website and what
pages have been read.
Maximum Storage Duration: SessionType: HTML Local Storage
* Marketing 110
Marketing cookies are used to track visitors across websites. The intention
is to display ads that are relevant and engaging for the individual user and
thereby more valuable for publishers and third party advertisers.
* Meta Platforms, Inc.
4
Learn more about this provider
lastExternalReferrerDetects how the user reached the website by
registering their last URL-address.
Maximum Storage Duration: PersistentType: HTML Local Storage
lastExternalReferrerTimeDetects how the user reached the website by
registering their last URL-address.
Maximum Storage Duration: PersistentType: HTML Local Storage
_fbp [x2]Used by Facebook to deliver a series of advertisement products
such as real time bidding from third party advertisers.
Maximum Storage Duration: 3 monthsType: HTTP Cookie
* Appnexus
3
Learn more about this provider
anjRegisters a unique ID that identifies a returning user's device. The ID
is used for targeted ads.
Maximum Storage Duration: 3 monthsType: HTTP Cookie
uuid2Registers a unique ID that identifies a returning user's device. The
ID is used for targeted ads.
Maximum Storage Duration: 3 monthsType: HTTP Cookie
XANDR_PANIDThis cookie registers data on the visitor. The information is
used to optimize advertisement relevance.
Maximum Storage Duration: 3 monthsType: HTTP Cookie
* Beeswax
2
Learn more about this provider
bitoSets a unique ID for the visitor, that allows third party advertisers
to target the visitor with relevant advertisement. This pairing service is
provided by third party advertisement hubs, which facilitates real-time
bidding for advertisers.
Maximum Storage Duration: 13 monthsType: HTTP Cookie
bitoIsSecurePresents the user with relevant content and advertisement. The
service is provided by third-party advertisement hubs, which facilitate
real-time bidding for advertisers.
Maximum Storage Duration: 13 monthsType: HTTP Cookie
* Google
9
Learn more about this provider
Some of the data collected by this provider is for the purposes of
personalization and measuring advertising effectiveness.
activity;register_conversion=#;#=#Pending
Maximum Storage Duration: SessionType: Pixel Tracker
IDEUsed by Google DoubleClick to register and report the website user's
actions after viewing or clicking one of the advertiser's ads with the
purpose of measuring the efficacy of an ad and to present targeted ads to
the user.
Maximum Storage Duration: 400 daysType: HTTP Cookie
pagead/landing [x2]Collects data on visitor behaviour from multiple
websites, in order to present more relevant advertisement - This also
allows the website to limit the number of times that they are shown the
same advertisement.
Maximum Storage Duration: SessionType: Pixel Tracker
ads/ga-audiencesUsed by Google AdWords to re-engage visitors that are
likely to convert to customers based on the visitor's online behaviour
across websites.
Maximum Storage Duration: SessionType: Pixel Tracker
NIDRegisters a unique ID that identifies a returning user's device. The ID
is used for targeted ads.
Maximum Storage Duration: 6 monthsType: HTTP Cookie
pagead/1p-user-list/#Tracks if the user has shown interest in specific
products or events across multiple websites and detects how the user
navigates between sites. This is used for measurement of advertisement
efforts and facilitates payment of referral-fees between websites.
Maximum Storage Duration: SessionType: Pixel Tracker
_gcl_au [x2]Used by Google AdSense for experimenting with advertisement
efficiency across websites using their services.
Maximum Storage Duration: 3 monthsType: HTTP Cookie
* LinkedIn
3
Learn more about this provider
bcookieUsed by the social networking service, LinkedIn, for tracking the
use of embedded services.
Maximum Storage Duration: 1 yearType: HTTP Cookie
bscookieUsed by the social networking service, LinkedIn, for tracking the
use of embedded services.
Maximum Storage Duration: 1 yearType: HTTP Cookie
UserMatchHistoryEnsures visitor browsing-security by preventing cross-site
request forgery. This cookie is essential for the security of the website
and visitor.
Maximum Storage Duration: 1 monthType: HTTP Cookie
* Marketo
2
Learn more about this provider
_mkto_trk [x2]Contains data on visitor behaviour and website interaction.
This is used in context with the email marketing service Marketo.com,
which allows the website to target visitors via email.
Maximum Storage Duration: 401 daysType: HTTP Cookie
* Microsoft
15
Learn more about this provider
_uetsid [x2]Used to track visitors on multiple websites, in order to
present relevant advertisement based on the visitor's preferences.
Maximum Storage Duration: PersistentType: HTML Local Storage
_uetsid_exp [x2]Contains the expiry-date for the cookie with corresponding
name.
Maximum Storage Duration: PersistentType: HTML Local Storage
_uetvid [x2]Used to track visitors on multiple websites, in order to
present relevant advertisement based on the visitor's preferences.
Maximum Storage Duration: PersistentType: HTML Local Storage
_uetvid_exp [x2]Contains the expiry-date for the cookie with corresponding
name.
Maximum Storage Duration: PersistentType: HTML Local Storage
MRUsed to track visitors on multiple websites, in order to present
relevant advertisement based on the visitor's preferences.
Maximum Storage Duration: 7 daysType: HTTP Cookie
MSPTCThis cookie registers data on the visitor. The information is used to
optimize advertisement relevance.
Maximum Storage Duration: 1 yearType: HTTP Cookie
MUIDUsed widely by Microsoft as a unique user ID. The cookie enables user
tracking by synchronising the ID across many Microsoft domains.
Maximum Storage Duration: 1 yearType: HTTP Cookie
_uetsid [x2]Collects data on visitor behaviour from multiple websites, in
order to present more relevant advertisement - This also allows the
website to limit the number of times that they are shown the same
advertisement.
Maximum Storage Duration: 2 daysType: HTTP Cookie
_uetvid [x2]Used to track visitors on multiple websites, in order to
present relevant advertisement based on the visitor's preferences.
Maximum Storage Duration: 1 yearType: HTTP Cookie
* StackAdapt
19
Learn more about this provider
sa-user-id [x2]Used to track visitors on multiple websites, in order to
present relevant advertisement based on the visitor's preferences.
Maximum Storage Duration: PersistentType: HTML Local Storage
sa-user-id [x4]Used to track visitors on multiple websites, in order to
present relevant advertisement based on the visitor's preferences.
Maximum Storage Duration: 1 yearType: HTTP Cookie
sa-user-id-v2 [x4]Used to track visitors on multiple websites, in order to
present relevant advertisement based on the visitor's preferences.
Maximum Storage Duration: 1 yearType: HTTP Cookie
sa-user-id-v2 [x2]Used to track visitors on multiple websites, in order to
present relevant advertisement based on the visitor's preferences.
Maximum Storage Duration: PersistentType: HTML Local Storage
sa-user-id-v3 [x3]Collects data on the user across websites - This data is
used to make advertisement more relevant.
Maximum Storage Duration: 1 yearType: HTTP Cookie
convPending
Maximum Storage Duration: SessionType: Pixel Tracker
sa-u-datePending
Maximum Storage Duration: PersistentType: HTML Local Storage
sa-user-id-v3Collects data on the user across websites - This data is used
to make advertisement more relevant.
Maximum Storage Duration: PersistentType: HTML Local Storage
sa-u-sourcePending
Maximum Storage Duration: PersistentType: HTML Local Storage
* The Trade Desk
1
Learn more about this provider
track/pxlPresents the user with relevant content and advertisement. The
service is provided by third-party advertisement hubs, which facilitate
real-time bidding for advertisers.
Maximum Storage Duration: SessionType: Pixel Tracker
* Twitter Inc.
3
Learn more about this provider
i/adsct [x2]The cookie is used by Twitter.com in order to determine the
number of visitors accessing the website through Twitter advertisement
content.
Maximum Storage Duration: SessionType: Pixel Tracker
muc_adsCollects data on user behaviour and interaction in order to
optimize the website and make advertisement on the website more relevant.
Maximum Storage Duration: 400 daysType: HTTP Cookie
* YouTube
22
Learn more about this provider
#-#Used to track user’s interaction with embedded content.
Maximum Storage Duration: SessionType: HTML Local Storage
__Secure-ROLLOUT_TOKENPending
Maximum Storage Duration: 180 daysType: HTTP Cookie
iU5q-!O9@$Registers a unique ID to keep statistics of what videos from
YouTube the user has seen.
Maximum Storage Duration: SessionType: HTML Local Storage
LAST_RESULT_ENTRY_KEYUsed to track user’s interaction with embedded
content.
Maximum Storage Duration: SessionType: HTTP Cookie
LogsDatabaseV2:V#||LogsRequestsStoreUsed to track user’s interaction with
embedded content.
Maximum Storage Duration: PersistentType: IndexedDB
nextIdUsed to track user’s interaction with embedded content.
Maximum Storage Duration: SessionType: HTTP Cookie
remote_sidNecessary for the implementation and functionality of YouTube
video-content on the website.
Maximum Storage Duration: SessionType: HTTP Cookie
requestsUsed to track user’s interaction with embedded content.
Maximum Storage Duration: SessionType: HTTP Cookie
ServiceWorkerLogsDatabase#SWHealthLogNecessary for the implementation and
functionality of YouTube video-content on the website.
Maximum Storage Duration: PersistentType: IndexedDB
TESTCOOKIESENABLEDUsed to track user’s interaction with embedded content.
Maximum Storage Duration: 1 dayType: HTTP Cookie
VISITOR_INFO1_LIVETries to estimate the users' bandwidth on pages with
integrated YouTube videos.
Maximum Storage Duration: 180 daysType: HTTP Cookie
YSCRegisters a unique ID to keep statistics of what videos from YouTube
the user has seen.
Maximum Storage Duration: SessionType: HTTP Cookie
yt.innertube::nextIdRegisters a unique ID to keep statistics of what
videos from YouTube the user has seen.
Maximum Storage Duration: PersistentType: HTML Local Storage
ytidb::LAST_RESULT_ENTRY_KEYStores the user's video player preferences
using embedded YouTube video
Maximum Storage Duration: PersistentType: HTML Local Storage
YtIdbMeta#databasesUsed to track user’s interaction with embedded content.
Maximum Storage Duration: PersistentType: IndexedDB
yt-remote-cast-availableStores the user's video player preferences using
embedded YouTube video
Maximum Storage Duration: SessionType: HTML Local Storage
yt-remote-cast-installedStores the user's video player preferences using
embedded YouTube video
Maximum Storage Duration: SessionType: HTML Local Storage
yt-remote-connected-devicesStores the user's video player preferences
using embedded YouTube video
Maximum Storage Duration: PersistentType: HTML Local Storage
yt-remote-device-idStores the user's video player preferences using
embedded YouTube video
Maximum Storage Duration: PersistentType: HTML Local Storage
yt-remote-fast-check-periodStores the user's video player preferences
using embedded YouTube video
Maximum Storage Duration: SessionType: HTML Local Storage
yt-remote-session-appStores the user's video player preferences using
embedded YouTube video
Maximum Storage Duration: SessionType: HTML Local Storage
yt-remote-session-nameStores the user's video player preferences using
embedded YouTube video
Maximum Storage Duration: SessionType: HTML Local Storage
* adnxs.com
doubleclick.net
2
receive-cookie-deprecation [x2]Collects information on user behaviour on
multiple websites. This information is used in order to optimize the
relevance of advertisement on the website.
Maximum Storage Duration: 400 daysType: HTTP Cookie
* b.6sc.co
2
6suuidRegisters user behaviour and navigation on the website, and any
interaction with active campaigns. This is used for optimizing
advertisement and for efficient retargeting.
Maximum Storage Duration: 401 daysType: HTTP Cookie
v1/beacon/img.gifUsed in context with Account-Based-Marketing (ABM). The
cookie registers data such as IP-addresses, time spent on the website and
page requests for the visit. This is used for retargeting of multiple
users rooting from the same IP-addresses. ABM usually facilitates B2B
marketing purposes.
Maximum Storage Duration: SessionType: Pixel Tracker
* j.6sc.co
7
_an_uidPresents the user with relevant content and advertisement. The
service is provided by third-party advertisement hubs, which facilitate
real-time bidding for advertisers.
Maximum Storage Duration: 8 daysType: HTTP Cookie
_gd_session [x3]Collects visitor data related to the user's visits to the
website, such as the number of visits, average time spent on the website
and what pages have been loaded, with the purpose of displaying targeted
ads.
Maximum Storage Duration: SessionType: HTTP Cookie
_gd_visitor [x3]Collects visitor data related to the user's visits to the
website, such as the number of visits, average time spent on the website
and what pages have been loaded, with the purpose of displaying targeted
ads.
Maximum Storage Duration: 401 daysType: HTTP Cookie
* netskopestage.wpengine.com
www.netskope.com
14
campaignid [x2]This cookie registers data on the visitor. The information
is used to optimize advertisement relevance.
Maximum Storage Duration: 1 dayType: HTTP Cookie
gclid [x2]Used to send data to Google Analytics about the visitor's device
and behavior. Tracks the visitor across devices and marketing channels.
Maximum Storage Duration: 1 dayType: HTTP Cookie
utm_campaign [x2]Collects information on user preferences and/or
interaction with web-campaign content - This is used on
CRM-campaign-platform used by website owners for promoting events or
products.
Maximum Storage Duration: 1 dayType: HTTP Cookie
utm_content [x2]Used to send data to Google Analytics about the visitor's
device and behavior. Tracks the visitor across devices and marketing
channels.
Maximum Storage Duration: 1 dayType: HTTP Cookie
utm_medium [x2]Collects information on user preferences and/or interaction
with web-campaign content - This is used on CRM-campaign-platform used by
website owners for promoting events or products.
Maximum Storage Duration: 1 dayType: HTTP Cookie
utm_source [x2]Determines how the user accessed the website. This
information is used by the website operator in order to measure the
efficiency of their marketing.
Maximum Storage Duration: 1 dayType: HTTP Cookie
utm_term [x2]Determines how the user accessed the website. This
information is used by the website operator in order to measure the
efficiency of their marketing.
Maximum Storage Duration: 1 dayType: HTTP Cookie
* www.netskope.com
wpengine.com
2
#GUID#23 [x2]Pending
Maximum Storage Duration: SessionType: HTTP Cookie
* Unclassified 31
Unclassified cookies are cookies that we are in the process of classifying,
together with the providers of individual cookies.
* CrazyEgg
1
Learn more about this provider
ce_localstorage_testPending
Maximum Storage Duration: PersistentType: HTML Local Storage
* Google
2
Learn more about this provider
Some of the data collected by this provider is for the purposes of
personalization and measuring advertising effectiveness.
_ga_PLFRVWX [x2]Pending
Maximum Storage Duration: 2 yearsType: HTTP Cookie
* Netskope
1
Learn more about this provider
unifiedScriptVerifiedPending
Maximum Storage Duration: SessionType: HTML Local Storage
* StackAdapt
4
Learn more about this provider
sa-u-date [x2]Pending
Maximum Storage Duration: 30 daysType: HTTP Cookie
sa-u-source [x2]Pending
Maximum Storage Duration: 30 daysType: HTTP Cookie
* cdn.cr-relay.com
2
signals-sdk-session-idPending
Maximum Storage Duration: 1 dayType: HTTP Cookie
signals-sdk-user-idPending
Maximum Storage Duration: 1 yearType: HTTP Cookie
* js.qualified.com
3
__q_local_form_debugPending
Maximum Storage Duration: PersistentType: HTML Local Storage
__q_state_n7t9Zf7nr8m6n2fF [x2]Pending
Maximum Storage Duration: 401 daysType: HTTP Cookie
* js.zi-scripts.com
2
_zitok [x2]Pending
Maximum Storage Duration: 1 yearType: HTTP Cookie
* netskopestage.wpengine.com
www.netskope.com
14
algoliasearch-client-js-#.#.#-01234VWXYZ [x2]Pending
Maximum Storage Duration: PersistentType: HTML Local Storage
campaign_member_status [x2]Pending
Maximum Storage Duration: 1 dayType: HTTP Cookie
cookie_banner_closed [x2]Pending
Maximum Storage Duration: 1 yearType: HTTP Cookie
domain_tracker/_cloudexchange/index.html [x2]Pending
Maximum Storage Duration: PersistentType: HTML Local Storage
experience_tracker/_cloudexchange/index.html [x2]Pending
Maximum Storage Duration: PersistentType: HTML Local Storage
marketing_cta [x2]Pending
Maximum Storage Duration: 1 dayType: HTTP Cookie
mobile-help-overlay [x2]Pending
Maximum Storage Duration: SessionType: HTTP Cookie
* www.netskope.com
wpengine.com
2
cerosdomaintracking [x2]Pending
Maximum Storage Duration: SessionType: HTTP Cookie
Cross-domain consent3 Your consent applies to the following domains:
List of domains your consent applies to: netskopestage.wpengine.com
go.netskope.com netskope.com
Cookie declaration last updated on 2024-11-29 by Cookiebot
[#IABV2_TITLE#]
[#IABV2_BODY_INTRO#]
[#IABV2_BODY_LEGITIMATE_INTEREST_INTRO#]
[#IABV2_BODY_PREFERENCE_INTRO#]
[#IABV2_LABEL_PURPOSES#]
[#IABV2_BODY_PURPOSES_INTRO#]
[#IABV2_BODY_PURPOSES#]
[#IABV2_LABEL_FEATURES#]
[#IABV2_BODY_FEATURES_INTRO#]
[#IABV2_BODY_FEATURES#]
[#IABV2_LABEL_PARTNERS#]
[#IABV2_BODY_PARTNERS_INTRO#]
[#IABV2_BODY_PARTNERS#]
Cookies are small text files that can be used by websites to make a user's
experience more efficient.
The law states that we can store cookies on your device if they are strictly
necessary for the operation of this site. For all other types of we need your
permission.
This site uses different types of cookies. Some cookies are placed by third
party services that appear on our pages.
You can at any time change or withdraw your consent from the Cookie Declaration
on our website.
Learn more about who we are, how you can contact us and how we process personal
data in our Privacy Policy.
Do not sell or share my personal information
Use necessary cookies only Allow selection Customize
Allow all cookies
Quantify the value of Netskope One SSE – Get the 2024 Forrester Total Economic
Impact™ study
* Why Netskope
* Platform
* Products
* Solutions
* Resources
* Company
Get Started
EN
* English
* Français
* 日本語
* Español
* Português
* Deutsch
Support
* Back
* English
* Français
* 日本語
* Español
* Português
* Deutsch
* Why Netskope
* Why Netskope
Why Netskope
Changing the way networking and security work together.
A Leader in SSE. Now a Leader in Single-Vendor SASE.
Learn why Netskope debuted as a leader in the 2024 Gartner® Magic
Quadrant™️ for Single-Vendor Secure Access Service Edge
Get the report
* Why Netskope
* A Leader in Security Service Edge (SSE)
* A Leader in Secure Access Service Edge (SASE)
* A Forrester Wave™ SSE Solutions Leader
* Achieve Business Value with Netskope One SSE
* Awards
* AI Labs
* Experience Netskope
* Why Netskope
Our Customers
Netskope serves more than 3,400 customers worldwide including more than 30
of the Fortune 100
Customer Visionary Spotlights
Read how innovative customers are successfully navigating today’s changing
networking & security landscape through the Netskope One platform.
Get the eBook
* Our Customers
* Case Studies
* Customer Solutions
* Why Netskope
Our Partners
We partner with security leaders to help you secure your journey to the
cloud.
Netskope’s partner-centric go-to-market strategy enables our partners to
maximize their growth and profitability while transforming enterprise
security.
Learn about Netskope Partners
* Partners
* Technology Partners
* Solution Providers
* Service Delivery Specialization
* Service Providers
* System Integrators
* Partner Portal
* Platform
* Platform
Netskope One Platform
Netskope One is a converged security and network as a service platform.
Your Network of Tomorrow
Plan your path toward a faster, more secure, and more resilient network
designed for the applications and users that you support.
Get the white paper
* Netskope One
* Zero Trust Engine
* NewEdge Network
* Client
* Advanced Analytics
* Cloud Exchange
* Deployment Options
* Digital Experience Management
* SkopeAI
* Platform
Technology Partners & Integrations
Netskope partners with the strongest companies in enterprise technology.
Netskope Cloud Exchange
The Netskope Cloud Exchange (CE) provides customers with powerful
integration tools to leverage investments across their security posture.
Learn about Cloud Exchange
* Technology Partners & Integrations Overview
* Our Technology Partners
* Cloud Exchange
* Products
* Products
Security Service Edge
Protect against advanced and cloud-enabled threats and safeguard data
across all vectors.
The platform of the future is Netskope
Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud
Firewall, Next Generation Secure Web Gateway (SWG), and Private Access for
ZTNA built natively into a single solution to help every business on its
journey to Secure Access Service Edge (SASE) architecture.
Go to Products Overview
* Security Service Edge (SSE)
* Next Gen Secure Web Gateway (SWG)
* Firewall (FWaaS)
* Remote Browser Isolation (RBI)
* Cloud Access Security Broker (CASB)
* SaaS Security Posture Management (SSPM)
* Private Access
* Data Loss Prevention (DLP)
* Data Security Posture Management (DSPM)
* Device Intelligence
* Threat Protection
* Products
SD-WAN
Confidently provide secure, high-performance access to every remote user,
device, site, and cloud.
Next Gen SASE Branch is hybrid — connected, secured, and automated
Netskope Next Gen SASE Branch converges Context-Aware SASE Fabric,
Zero-Trust Hybrid Security, and SkopeAI-powered Cloud Orchestrator into a
unified cloud offering, ushering in a fully modernized branch experience
for the borderless enterprise.
Learn about Next Gen SASE Branch
* SD-WAN
* SASE Branch
* Endpoint SD-WAN
* IoT Intelligent Access
* Micro Branch
* Multi-Cloud Networking
* Wireless WAN
* Products
Secure Access Service Edge
Netskope One SASE provides a cloud-native, fully-converged and
single-vendor SASE solution.
SASE Architecture For Dummies
Get your complimentary copy of the only guide to SASE design you’ll ever
need.
Get the eBook
* Secure Access Service Edge (SASE)
* Solutions
* Solutions
Network Transformation
Achieve agility and efficiency through digital transformation.
Make the move to market-leading cloud security services with minimal
latency and high reliability.
Learn about NewEdge
* Hybrid Work
* Replace VPNs
* Simplify Operations
* SD-WAN
Go to Solutions Overview
* Solutions
Security modernization
Meet the security challenges of today and tomorrow.
Safely enable the use of generative AI applications with application access
control, real-time user coaching, and best-in-class data protection.
Learn how we secure generative AI use
* Advanced Threat Protection
* Data Protection
* Hybrid Work
* Insider Risk
* Maintain Compliance
* Replace VPNs
* Safely Enable ChatGPT and Generative AI
* Secure Managed Cloud Applications
* Secure Unmanaged Cloud Services
* AWS, Azure & GCP
Go to Solutions Overview
* Solutions
Frameworks
Embrace the regulatory frameworks shaping cybersecurity.
Zero trust solutions for SSE and SASE deployments
Learn about Zero Trust
* Secure Access Service Edge (SASE)
* Zero Trust
Go to Solutions Overview
* Solutions
Government and Industries
Netskope helps the largest agencies and enterprises in the world secure
their journey to the cloud.
Netskope achieves FedRAMP High Authorization
Choose Netskope GovCloud to accelerate your agency’s transformation.
Learn about Netskope GovCloud
* Financial Services and Insurance
* Healthcare and Life Sciences
* High Technology
* Higher Education Institutions
* K12
* Legal
* Manufacturing
* US Public Sector
* UK Public Sector
* Australian Government
* Retail and Hospitality
* Service Companies
* Utilities
* Resources
* Resources
Resources
Learn more about how Netskope can help you secure your journey to the
cloud.
Security Visionaries Podcast
2025 Predictions
In this episode of Security Visionaries, we're joined by Kiersten Todt,
President at Wondros and former Chief of Staff for the Cybersecurity and
Infrastructure Security Agency (CISA) to discuss predictions for 2025 and
beyond.
Play the podcast Browse all podcasts
* Resource Library
* Analyst Reports
* Case Studies
* Compliance Guides
* Data Sheets
* Demos & Videos
* eBooks
* Podcasts
* Product Documentation
* Reports & Guides
* Solution Briefs
* Webinars
* White Papers
* Threat Labs
* Resources
Blog
Learn how Netskope enables security and networking transformation through
secure access service edge (SASE)
Latest Blogs
Read how Netskope can enable the Zero Trust and SASE journey through secure
access service edge (SASE) capabilities.
Read the blog
* Netskope Blog
* Behind the Scenes
* Full Skope
* News & Announcements
* Platform, Products, & Services
* Threat Labs
* Resources
Events and Workshops
Stay ahead of the latest security trends and connect with your peers.
SASE Week 2024 On-Demand
Learn how to navigate the latest advancements in SASE and zero trust and
explore how these frameworks are adapting to address cybersecurity and
infrastructure challenges
Explore sessions
* Events
* Experience Netskope
* SASE Week
* Netskope SASE Summit
* The SASE Accreditation
* Unpacking Webinar Series
* Webinars On-Demand
* Resources
Security Defined
Everything you need to know in our cybersecurity encyclopedia.
What is SASE?
Learn about the future convergence of networking and security tools in
today’s cloud dominant business model.
Learn about SASE
* Security Defined overview
* What is SASE?
* What is Security Service Edge?
* What is a Cloud Access Security Broker (CASB)?
* What is Zero Trust Network Access (ZTNA)?
* What is a Next Generation Secure Web Gateway (SWG)?
* What is Data Loss Prevention (DLP)?
* What is SD-WAN?
* What is Generative AI?
* What is SSPM?
* What is FedRamp?
* Company
* Company
Company
We help you stay ahead of cloud, data, and network security challenges.
Supporting sustainability through data security
Netskope is proud to participate in Vision 2045: an initiative aimed to
raise awareness on private industry’s role in sustainability.
Find out more
* Corporate Overview
* Leadership Team
* Corporate Social Responsibility
* Diversity, Equity, and Inclusion
* Events
* Executive Briefing Program
* Newsroom
* Press Releases
* Security, Compliance & Assurance
* Company
Careers
Join Netskope's 3,000+ amazing team members building the industry’s leading
cloud-native security platform.
Help shape the future of cloud security
At Netskope, founders and leaders work shoulder-to-shoulder with their
colleagues, even the most renowned experts check their egos at the door,
and the best ideas win.
Join the team
* Careers
* Job Openings
* Company
Customer Solutions
We are here for you and with you every step of the way, ensuring your
success with Netskope.
Netskope dedicated service and support professionals will ensure you
successful deploy and experience the full value of our platform.
Go to Customer Solutions
* Professional Services
* Customer Success
* Technical Support
* Service Delivery Partners
* Customer Community
* Product Documentation
* Support Portal
* Trust Portal
Go to Customer Solutions
* Company
Training and Accreditations
Netskope training will help you become a cloud security expert.
Secure your digital transformation journey and make the most of your cloud,
web, and private applications with Netskope training.
Learn about Training and Certifications
* Netskope Security Cloud Introductory Online Technical Training
* Netskope Security Cloud Operation and Administration (NSCO&A)
* Netskope Security Cloud Implementation and Integration (NSCI&I)
Netskope Training
Support Language
* Why Netskope
Changing the way networking and security work together.
* Our Customers
Netskope serves more than 3,400 customers worldwide including more than 30 of
the Fortune 100
* Our Partners
We partner with security leaders to help you secure your journey to the
cloud.
* Why Netskope
* A Leader in Security Service Edge (SSE)
* A Leader in Secure Access Service Edge (SASE)
* A Forrester Wave™ SSE Solutions Leader
* Achieve Business Value with Netskope One SSE
* Awards
* AI Labs
* Experience Netskope
* Our Customers
* Case Studies
* Customer Solutions
* Partners
* Technology Partners
* Solution Providers
* Service Delivery Specialization
* Service Providers
* System Integrators
* Partner Portal
A Leader in SSE. Now a Leader in Single-Vendor SASE.
Learn why Netskope debuted as a leader in the 2024 Gartner® Magic Quadrant™️ for
Single-Vendor Secure Access Service Edge
Get the report
Customer Visionary Spotlights
Read how innovative customers are successfully navigating today’s changing
networking & security landscape through the Netskope One platform.
Get the eBook
Netskope’s partner-centric go-to-market strategy enables our partners to
maximize their growth and profitability while transforming enterprise security.
Learn about Netskope Partners
* Netskope One Platform
Netskope One is a converged security and network as a service platform.
* Technology Partners & Integrations
Netskope partners with the strongest companies in enterprise technology.
* Netskope One
* Zero Trust Engine
* NewEdge Network
* Client
* Advanced Analytics
* Cloud Exchange
* Deployment Options
* Digital Experience Management
* SkopeAI
* Technology Partners & Integrations Overview
* Our Technology Partners
* Cloud Exchange
Your Network of Tomorrow
Plan your path toward a faster, more secure, and more resilient network designed
for the applications and users that you support.
Get the white paper
Netskope Cloud Exchange
The Netskope Cloud Exchange (CE) provides customers with powerful integration
tools to leverage investments across their security posture.
Learn about Cloud Exchange
* Security Service Edge
Protect against advanced and cloud-enabled threats and safeguard data across
all vectors.
* SD-WAN
Confidently provide secure, high-performance access to every remote user,
device, site, and cloud.
* Secure Access Service Edge
Netskope One SASE provides a cloud-native, fully-converged and single-vendor
SASE solution.
* Security Service Edge (SSE)
* Next Gen Secure Web Gateway (SWG)
* Firewall (FWaaS)
* Remote Browser Isolation (RBI)
* Cloud Access Security Broker (CASB)
* SaaS Security Posture Management (SSPM)
* Private Access
* Data Loss Prevention (DLP)
* Data Security Posture Management (DSPM)
* Device Intelligence
* Threat Protection
* SD-WAN
* SASE Branch
* Endpoint SD-WAN
* IoT Intelligent Access
* Micro Branch
* Multi-Cloud Networking
* Wireless WAN
* Secure Access Service Edge (SASE)
The platform of the future is Netskope
Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud
Firewall, Next Generation Secure Web Gateway (SWG), and Private Access for ZTNA
built natively into a single solution to help every business on its journey to
Secure Access Service Edge (SASE) architecture.
Go to Products Overview
Next Gen SASE Branch is hybrid — connected, secured, and automated
Netskope Next Gen SASE Branch converges Context-Aware SASE Fabric, Zero-Trust
Hybrid Security, and SkopeAI-powered Cloud Orchestrator into a unified cloud
offering, ushering in a fully modernized branch experience for the borderless
enterprise.
Learn about Next Gen SASE Branch
SASE Architecture For Dummies
Get your complimentary copy of the only guide to SASE design you’ll ever need.
Get the eBook
* Network Transformation
Achieve agility and efficiency through digital transformation.
* Security modernization
Meet the security challenges of today and tomorrow.
* Frameworks
Embrace the regulatory frameworks shaping cybersecurity.
* Government and Industries
Netskope helps the largest agencies and enterprises in the world secure their
journey to the cloud.
* Hybrid Work
* Replace VPNs
* Simplify Operations
* SD-WAN
Go to Solutions Overview
* Advanced Threat Protection
* Data Protection
* Hybrid Work
* Insider Risk
* Maintain Compliance
* Replace VPNs
* Safely Enable ChatGPT and Generative AI
* Secure Managed Cloud Applications
* Secure Unmanaged Cloud Services
* AWS, Azure & GCP
Go to Solutions Overview
* Secure Access Service Edge (SASE)
* Zero Trust
Go to Solutions Overview
* Financial Services and Insurance
* Healthcare and Life Sciences
* High Technology
* Higher Education Institutions
* K12
* Legal
* Manufacturing
* US Public Sector
* UK Public Sector
* Australian Government
* Retail and Hospitality
* Service Companies
* Utilities
Make the move to market-leading cloud security services with minimal latency and
high reliability.
Learn about NewEdge
Safely enable the use of generative AI applications with application access
control, real-time user coaching, and best-in-class data protection.
Learn how we secure generative AI use
Zero trust solutions for SSE and SASE deployments
Learn about Zero Trust
Netskope achieves FedRAMP High Authorization
Choose Netskope GovCloud to accelerate your agency’s transformation.
Learn about Netskope GovCloud
* Resources
Learn more about how Netskope can help you secure your journey to the cloud.
* Blog
Learn how Netskope enables security and networking transformation through
secure access service edge (SASE)
* Events and Workshops
Stay ahead of the latest security trends and connect with your peers.
* Security Defined
Everything you need to know in our cybersecurity encyclopedia.
* Resource Library
* Analyst Reports
* Case Studies
* Compliance Guides
* Data Sheets
* Demos & Videos
* eBooks
* Podcasts
* Product Documentation
* Reports & Guides
* Solution Briefs
* Webinars
* White Papers
* Threat Labs
* Netskope Blog
* Behind the Scenes
* Full Skope
* News & Announcements
* Platform, Products, & Services
* Threat Labs
* Events
* Experience Netskope
* SASE Week
* Netskope SASE Summit
* The SASE Accreditation
* Unpacking Webinar Series
* Webinars On-Demand
* Security Defined overview
* What is SASE?
* What is Security Service Edge?
* What is a Cloud Access Security Broker (CASB)?
* What is Zero Trust Network Access (ZTNA)?
* What is a Next Generation Secure Web Gateway (SWG)?
* What is Data Loss Prevention (DLP)?
* What is SD-WAN?
* What is Generative AI?
* What is SSPM?
* What is FedRamp?
Security Visionaries Podcast
2025 Predictions
In this episode of Security Visionaries, we're joined by Kiersten Todt,
President at Wondros and former Chief of Staff for the Cybersecurity and
Infrastructure Security Agency (CISA) to discuss predictions for 2025 and
beyond.
Play the podcast Browse all podcasts
Latest Blogs
Read how Netskope can enable the Zero Trust and SASE journey through secure
access service edge (SASE) capabilities.
Read the blog
SASE Week 2024 On-Demand
Learn how to navigate the latest advancements in SASE and zero trust and explore
how these frameworks are adapting to address cybersecurity and infrastructure
challenges
Explore sessions
What is SASE?
Learn about the future convergence of networking and security tools in today’s
cloud dominant business model.
Learn about SASE
* Company
We help you stay ahead of cloud, data, and network security challenges.
* Careers
Join Netskope's 3,000+ amazing team members building the industry’s leading
cloud-native security platform.
* Customer Solutions
We are here for you and with you every step of the way, ensuring your success
with Netskope.
* Training and Accreditations
Netskope training will help you become a cloud security expert.
* Corporate Overview
* Leadership Team
* Corporate Social Responsibility
* Diversity, Equity, and Inclusion
* Events
* Executive Briefing Program
* Newsroom
* Press Releases
* Security, Compliance & Assurance
* Careers
* Job Openings
* Professional Services
* Customer Success
* Technical Support
* Service Delivery Partners
* Customer Community
* Product Documentation
* Support Portal
* Trust Portal
Go to Customer Solutions
* Netskope Security Cloud Introductory Online Technical Training
* Netskope Security Cloud Operation and Administration (NSCO&A)
* Netskope Security Cloud Implementation and Integration (NSCI&I)
Netskope Training
Supporting sustainability through data security
Netskope is proud to participate in Vision 2045: an initiative aimed to raise
awareness on private industry’s role in sustainability.
Find out more
Help shape the future of cloud security
At Netskope, founders and leaders work shoulder-to-shoulder with their
colleagues, even the most renowned experts check their egos at the door, and the
best ideas win.
Join the team
Netskope dedicated service and support professionals will ensure you successful
deploy and experience the full value of our platform.
Go to Customer Solutions
Secure your digital transformation journey and make the most of your cloud, web,
and private applications with Netskope training.
Learn about Training and Certifications
* Blog
* Threat Labs
* New Python NodeStealer Goes Beyond Facebook Credentials, Now Stealing All
Browser Cookies and Login Credentials
NEW PYTHON NODESTEALER GOES BEYOND FACEBOOK CREDENTIALS, NOW STEALING ALL
BROWSER COOKIES AND LOGIN CREDENTIALS
Sep 14 2023
By Jan Michael Alcantara
Share this article
Share
Request Demo
SUMMARY
Netskope Threat Labs is tracking a campaign that uses malicious Python scripts
to steal Facebook users’ credentials and browser data. This campaign targets
Facebook business accounts with bogus Facebook messages with a malicious file
attached. The attacks are reaching victims mainly in Southern Europe and North
America across different segments, led by the manufacturing services and
technology sectors.
In January 2023, Meta identified a JavaScript-based malware dubbed NodeStealer,
which aims to steal Facebook cookies and login credentials.
The present campaign appears to be a new variant of the Python-based NodeStealer
that still aims to compromise Facebook business accounts. However, unlike
previously reported NodeStealer versions, this one also pilfers all available
credentials and cookies, not just those of Facebook.
Let us explore how this new NodeStealer variant works.
NODESTEALER DISTRIBUTED VIA FACEBOOK MESSAGES.
The new NodeStealer variant we detected was hosted on the Facebook CDN and was
sent to victims as an attachment in Facebook messages. Images of defective
products were used as bait to convince owners or admins of Facebook business
pages to download the malware payload. Unlike previous NodeStealer campaigns,
this one uses a batch file instead of an executable as the initial payload.
NodeStealer sent via Facebook
We observed some identical batch files in multiple languages, indicating that
the attacker customized the attack for each demographic.
Identical batch scripts named in different language
Once the file is downloaded, users have to run the batch file. The batch file
uses a different character encoding,and opening it with a text editor by default
will show incoherent characters. This is an attempt to obfuscate the script and
hide its functions. Opening the file with a different encoding scheme will make
the script comprehensible.
Malicious batch file readable when opened with UTF-8 character encoding
Once the user runs the batch file, it will initially open a Chrome browser and
will land the victim on a benign page. The Chrome process will not be used later
on, which is why we suspect that it was only done to convince the user that the
file is benign.
However, in the background, Powershell is downloading several files from a
malicious newly-registered domain (vuagame[.]store) using Invoke-WebRequest. It
will initially download two zip files (Document.zip and 4HAI.zip), which will be
stored in the C:\Users\Public folder. Document.zip contains a Python interpreter
and its required DLLs and libraries, while 4HAI.zip contains the malware
payloads.
PERSISTENCE THROUGH STARTUP FOLDER
Another difference with this NodeStealer, compared to the previously disclosed
version, is the method for persistence. The “4HAI.zip” zip file contains another
malicious batch file that is copied to the startup folder. The batch file runs
Powershell to download and execute a malicious Python script named “project.py”.
Just like the previous batch file, changing the character encoding is required
to make the script legible.
After copying the batch file to the startup folder, another Python script named
rmv.py is downloaded and executed to delete artifacts left behind.
STOLEN CREDENTIALS AND BROWSER COOKIES
The malicious python script in the startup folder converts an embedded
hexadecimal encoded data into its binary representation. It was compressed
several times over to likely evade detection. After several decompressions, the
“exec” function is used to run the script.
Once it runs, one of the things the script checks is if there’s a Google Chrome
process running, which it will terminate if there is. As mentioned earlier,
Chrome is opened to access a benign website to put the user at ease. Ensuring
that Chrome is not running is required at this stage to access the browser data.
Script that checks and terminates Chrome
Afterwards, the Python-based NodeStealer will collect the user’s IP address and
country code using IPinfo. They will be used as a folder name where all
collected data will be saved.
The malicious script collects several Google Chrome browser files, namely Login
Data, Cookies and Local State. All copied files are then placed in a temp folder
with the user’s IP address and country code as the folder name. Similar to
previously disclosed NodeStealer, this one also targets several browsers,
specifically Microsoft Edge, Brave, Opera, Cốc Cốc, Opera, and Firefox. The
folder where the files are copied is deleted later on to remove evidence of the
exfiltrated files.
Collection of Google Chrome Cookies, Login Data and Local State
After collecting browser files, NodeStealer first collects the encryption key
found on the “Local State” file. This will be used later on to decrypt encrypted
passwords. It then collects the username, password, and the URL from which they
logged on, from the “Login Data” file. All data collected is then saved on a
text file named “Password.txt” located on the temp file created earlier.
NodeStealer also reads Cookie files and collects several pieces of data, such as
domain, cookie name and values, and other important data. Unlike the previously
reported NodeStealer, this variant will collect browser cookies regardless of
whether it is from Facebook or not. However, we can see that it still looks for
Facebook data since data collected from it is saved on a different text file.
Stealing users’ cookies can lead to more targeted attacks. Cookies may store
login credentials or active session data that can bypass the need to log in or
type in the multi-factor authentication code, which can help attackers take over
the victim’s account or make fraudulent transactions.
Facebook cookie data being saved separately to a different text file
EXFILTRATION VIA TELEGRAM
Just like the previously reported Python-based NodeStealer, all harvested files
are collected using Telegram.
Once the data is exfiltrated, the script performs a cleanup of all files and
folders it created. And since the malicious batch file is on the startup folder,
credentials and other browser data will continually be harvested.
Files collected will be deleted after exfiltration
CONCLUSION
This post described, what we believe, is a new variant of the Python-based
NodeStealer. Compared to earlier variants, the new NodeStealer variant uses
batch files to download and run Python scripts, and steal credentials and
cookies from multiple browsers and for multiple websites. This campaign might be
a doorway to a more targeted attack later on since they have already gathered
useful information. Attackers who have stolen Facebook cookies and credentials
can use them to take over the account, make fraudulent transactions leveraging
the legitimate business page. Users can protect their data from being stolen by
being vigilant on what they download over the internet. Do not download and open
files that you receive via social media, even if they appear to come from
someone you know.
RECOMMENDATIONS
The malicious files described in the post are distributed via social media
applications. Being mindful of URL links or attachments received even from known
sources can help prevent users from being victims of this campaign.
Netskope Threat Labs recommends that organizations review their security
policies to ensure that they are adequately protected against these and similar
phishing pages and scams. Other recommendations include:
* Inspect all HTTP and HTTPS traffic, including all web and cloud traffic, to
prevent users from visiting malicious websites. Netskope customers can
configure their Netskope NG-SWG with a URL filtering policy to block known
phishing and scam sites, and a threat protection policy to inspect all web
content to identify unknown phishing and scam sites using a combination of
signatures, threat intelligence, and machine learning.
PROTECTION
Netskope Threat Labs is actively monitoring this campaign and has ensured
coverage for all known threat indicators and payloads.
* Netskope Threat Protection
* Trojan.GenericKD.68681756
* Script.Trojan.Malgent
* Netskope Advanced Threat Protection provides proactive coverage against this
threat.
* Gen.Malware.Detect.By.StHeur indicates a sample that was detected using
static analysis
* Gen.Malware.Detect.By.Sandbox indicates a sample that was detected by our
cloud sandbox
IOCS
Below are the IOCs related to the web pages analyzed in this blog post.
URLs:
* hxxps://cdn.fbsbx.com/v/t59.2708-21/367434252_826968952391881_4583268091682907143_n.rar/image-product-103c3e2d4se43234ed22c19d3f47611e2e.rar
* hxxps://cdn.fbsbx.com/v/t59.2708-21/366790602_1527838844638580_5700504415987597148_n.rar/Bild-Produkt-1615448759625_19599_4e232787b5053ac7f631b0c701d2159c_1.rar
* hxxps://cdn.fbsbx.com/v/t59.2708-21/366774494_655373353219514_2097719301301827427_n.rar/photo-product-103c3e2d22c19d3f47611e2e.rar
* hxxps://cdn.fbsbx.com/v/t59.2708-21/366541252_307708121731913_2867761615862616633_n.rar/image-produit-103c3gdfe2d22c19d3f47611e2e.rar
* hxxps://cdn.fbsbx.com/v/t59.2708-21/366736184_272143855551717_1974995500254017245_n.rar/imagem-produto-103c3e2e43234ed22c19d3f47611e2e.rar
* hxxps://vuagame[.]store/rmv
* hxxps://vuagame[.]store/document.zip
* hxxps://vuagame[.]store/4HAI.zip
* hxxps://vuagame[.]store/4HA
MD5:
* 173b17e195b0a80611c22f333c3d2ec2
* 2dc191275434b6afe6c6117ad76051ed
* 13f94cda395bfdd2c87a024ee497e576
* 10f53e5d2eacf8912ca5d0516a8dc89f
* 64f4b6f2b2dfdd2e0c8c47e726f75e9a
* bfcce5cd48cc23071052120338df1226
< Threat Labs
Next Story >
< Back
Next >
Jan Michael Alcantara
Jan Michael Alcantara is an experienced incident responder with a background on
forensics, threat hunting, and incident analysis.
Jan Michael Alcantara is an experienced incident responder with a background on
forensics, threat hunting, and incident analysis.
Read More
More Articles by Jan Michael Alcantara
Read full Bio
More articles
RELATED ARTICLES
List Grid
Threat Labs
New Yokai Side-loaded Backdoor Targets Thai Officials
By Nikhil Hegde
Read the blog
Threat Labs
Netskope Threat Labs Predictions for 2025
By Netskope Staff
Read the blog
Threat Labs
Python NodeStealer Targets Facebook Ads Manager with New Techniques
By Jan Michael Alcantara
Read the blog
Show More
STAY INFORMED!
Subscribe for the latest from the Netskope Blog
What topics would you like to subscribe to?
*
Blog Topics:
Netskope Platform & Thought LeadershipAIThreat Labs
*
*
Country:
Select Country...United
States----------------------------------AfghanistanAlbaniaAlgeriaAmerican
SamoaAndorraAngolaAntigua and
BarbudaArgentinaArmeniaAustraliaAustriaAzerbaijanBahamasBahrainBangladeshBarbadosBelarusBelgiumBelizeBeninBermudaBhutanBoliviaBosnia
and HerzegovinaBotswanaBrazilBruneiBulgariaBurkina
FasoBurundiCambodiaCameroonCanadaCape VerdeCayman IslandsCentral African
RepublicChadChileChinaColombiaComorosCongo, Democratic Republic of theCongo,
Republic of theCosta RicaCôte d'IvoireCroatiaCubaCyprusCzech
RepublicDenmarkDjiboutiDominicaDominican RepublicEast TimorEcuadorEgyptEl
SalvadorEquatorial GuineaEritreaEstoniaEthiopiaFijiFinlandFranceFrench
PolynesiaGabonGambiaGeorgiaGermanyGhanaGreeceGreenlandGrenadaGuamGuatemalaGuineaGuinea-BissauGuyanaHaitiHondurasHong
KongHungaryIcelandIndiaIndonesiaIranIraqIrelandIsraelItalyJamaicaJapanJordanKazakhstanKenyaKiribatiNorth
KoreaSouth
KoreaKosovoKuwaitKyrgyzstanLaosLatviaLebanonLesothoLiberiaLibyaLiechtensteinLithuaniaLuxembourgMacedoniaMadagascarMalawiMalaysiaMaldivesMaliMaltaMarshall
IslandsMauritaniaMauritiusMexicoMicronesiaMoldovaMonacoMongoliaMontenegroMoroccoMozambiqueMyanmarNamibiaNauruNepalNetherlandsNew
ZealandNicaraguaNigerNigeriaNorwayNorthern Mariana
IslandsOmanPakistanPalauPalestinePanamaPapua New
GuineaParaguayPeruPhilippinesPolandPortugalPuerto
RicoQatarRomaniaRussiaRwandaSaint Kitts and NevisSaint LuciaSaint Vincent and
the GrenadinesSamoaSan MarinoSao Tome and PrincipeSaudi ArabiaSenegalSerbia and
MontenegroSeychellesSierra LeoneSingaporeSlovakiaSloveniaSolomon
IslandsSomaliaSouth AfricaSpainSri LankaSudanSudan,
SouthSurinameSwazilandSwedenSwitzerlandSyriaTaiwanTajikistanTanzaniaThailandTogoTongaTrinidad
and TobagoTunisiaTurkeyTurkmenistanTuvaluUgandaUkraineUnited Arab EmiratesUnited
KingdomUnited StatesUruguayUzbekistanVanuatuVatican CityVenezuelaVietnamVirgin
Islands, BritishVirgin Islands, U.S.YemenZambiaZimbabwe
Subscribe
* Explore
* Why Netskope
* Products
* Solutions
* What is SASE?
* What is SSE?
* What is Zero Trust?
* What is a Next Gen SWG?
* What is a CASB?
* Resources
* Blog
* Netskope Community
* Resource Library
* Security Defined
* Technical Support
* Threat Labs
* Trust Portal
* URL Lookup
* Company
* About Netskope
* Careers
* Events
* Executive Briefing Program
* Newsroom
* Our Customers
* Partners
* Partner portal
* Contact
* Contact Us
* 1-800-979-6988
* 2445 Augustine Dr. 3rd floor,
Santa Clara, CA 95054
* Privacy Policy
* Vulnerability Disclosure Policy
* Terms of Use
* CCPA Compliance Statement
© 2024, All rights reserved.