Fabookie

Fabookie is a Windows credential-stealing malware family focused on hijacking Facebook-related access, particularly Facebook Ads accounts, by stealing browser session cookies and authentication material. It has been described as a modular credential theft component with multiple modules for collecting authentication data for various services and websites, and is commonly categorized among information stealers.

Fabookie has been observed in malware distribution ecosystems operated on a pay-per-install basis, including campaigns using PrivateLoader and TaskLoader, and has also appeared in broader cracked-software and fake-installer delivery chains associated with malware droppers such as NullMixer. In these operations, victims are typically lured through pirated-software or fake software download themes and then infected with downstream payloads selected by the loader operator.

Operationally, Fabookie is associated with theft of browser session cookies rather than only static credentials, enabling attackers to abuse authenticated web sessions and monetize compromised Facebook advertising accounts. Reporting also notes use against Facebook Ads specifically. In at least one observed campaign, the Fabookie payload was concealed within an image as part of the delivery chain. The malware is primarily relevant to financially motivated cybercrime activity targeting users and organizations that manage online advertising assets.