Braodo Stealer Python-Based Credential Harvesting

The Braodo Stealer is a Python-based credential-harvesting malware identified in October 2026 that targets authenticated browser sessions to compromise user accounts. The malware specifically leverages the Meta Graph API to enumerate information related to the victim's Facebook and Meta advertising infrastructure. The threat is characterized by its execution from non-standard or highly suspicious directories on Windows systems, such as the Recycle Bin, Prefetch folders, or user-accessible public directories. By masquerading as standard Python binaries (e.g., python.exe, pythonw.exe), the malware attempts to blend into legitimate administrative or development activity. This campaign highlights the importance of monitoring process execution paths, especially for scripting engines that are frequently abused by attackers to facilitate command-and-control communication with legitimate social media infrastructure.

Attack Chain

1. Initial infection typically via a dropper or malicious payload delivery mechanism.
2. The malware drops a Python interpreter and supporting scripts into a non-standard location such as C:\Users\Public\ or C:\Windows\Temp.
3. The malware executes using a legitimate Python process name like python.exe or pythonw.exe to maintain a lower profile.
4. It scans the host environment for existing browser session cookies to identify active Meta or Facebook authentication tokens.
5. The Python script initiates an outbound connection to social media domains using its hijacked session context.
6. It interacts with the Meta Graph API to enumerate advertising account details and connected metadata.
7. Exfiltration of harvested credentials and advertising intelligence occurs over outbound HTTPS connections to Meta-affiliated infrastructure.

Impact

Successful execution of Braodo Stealer results in the compromise of victim credentials and the potential takeover of Facebook or Meta advertising accounts. This allows attackers to perform unauthorized operations, such as managing ads or exfiltrating sensitive organizational financial data stored within advertising dashboards. Given the reliance on authenticated sessions, the impact can bypass standard credential-based authentication.

Recommendation

Prioritize the implementation of process path monitoring for scripting environments.

• Deploy the provided Sigma rule to detect outbound connections from Python processes spawned from suspicious directories.
• Enable Sysmon Event ID 3 (Network Connection) logging across all endpoints to capture destination domains and associated processes.
• Monitor for Python-related binaries executing from directories such as $Recycle.Bin, \PerfLogs, or \Windows\Fonts.
• Restrict write access to sensitive system directories to prevent the placement of malicious scripts by non-privileged processes.