Torg Grabber: The Infostealer Silently Raiding Your Crypto Wallets
Cybersecurity researchers at Gen Digital have identified a fast-evolving malware-as-a-service threat called Torg Grabber, an information stealer engineered to drain cryptocurrency wallets, harvest browser credentials, and exfiltrate sensitive data at scale. Distributed via the ClickFix social engineering technique, this threat marks a significant escalation in the infostealer landscape.
What Happened
In March 2026, Gen Digital published a detailed technical report exposing Torg Grabber, a credential stealer circulating since December 2025. Initially mistaken for a Vidar variant, deeper analysis revealed an entirely distinct codebase with its own C2 infrastructure and operator network. The firm documented 334 unique compiled samples across a three-month window, with new command-and-control domains registered weekly and an expanding operator base of 40 documented tags.
Technical Details
Torg Grabber gains initial access through the ClickFix technique, hijacking clipboard content to trick victims into executing malicious PowerShell commands. The malware uses a seven-layer unpacking chain (base64, XOR, AES-CBC, hex-encoding, CTR cipher, LZNT1, and AES-CBC transforms) before deploying a 683KB stealer payload entirely in memory. Since December 22, 2025, it bypasses App-Bound Encryption in Chrome, Edge, Brave, Vivaldi, and Opera by injecting a 20KB DLL into a legitimate browser process to extract the master encryption key via COM Elevation Service. Data exfiltration is performed over HTTPS routed through Cloudflare infrastructure, using chunked uploads encrypted with ChaCha20 and authenticated with HMAC-SHA256 tokens.
Impact
Torg Grabber targets 25 Chromium-based browsers and 8 Firefox variants, stealing credentials, cookies, and autofill data from 850 browser extensions. Of these, 728 are cryptocurrency wallet extensions, covering virtually every major and obscure wallet including MetaMask, Phantom, TrustWallet, Coinbase, Binance, Exodus, and OKX. The malware also targets 103 password manager and 2FA extensions (LastPass, 1Password, Bitwarden, Authy), along with 19 note-taking apps, desktop crypto wallet applications, Discord, Telegram, Steam, VPN clients, FTP tools, and email clients. Additionally, it profiles the host system, captures screenshots, steals files from Desktop and Documents folders, and can execute attacker-supplied shellcode.
Related: How to Check MFA Status for Users in Microsoft Entra ID
Related: How to Force Password Changes for All Users in Microsoft 365
Related: How to Export BitLocker Recovery Keys from Active Directory
Related: How to Monitor Active Directory Health with PowerShell
Mitigation
No patch is applicable for this threat as it is a malware campaign rather than a software vulnerability. Users should never run clipboard-based commands prompted by websites. Organizations are advised to enforce application allowlisting, restrict PowerShell execution via policy, deploy endpoint detection and response (EDR) solutions capable of detecting reflective DLL loading and in-memory execution, and monitor for anomalous HTTPS traffic to Cloudflare-hosted infrastructure. Crypto wallet holders should consider using hardware wallets and enabling all available browser security features.
