A newly identified Windows infostealer, CharlieKirk Grabber, is targeting users with a fast “smash-and-grab” approach to credential theft. The malware is written in Python and packaged into a standalone Windows executable using PyInstaller.
First observed in February 2026, the sample analyzed was unsigned and designed to execute under the context of the logged-in user.
Unlike advanced threats that focus on persistence or long-term control, CharlieKirk Grabber prioritizes immediate data harvesting and rapid exfiltration.
Its primary goal is to steal login credentials, browser data, session tokens, and system identifiers before exiting the system.
Rapid Credential Harvesting and Living-Off-the-Land Techniques
Once executed, the malware performs system reconnaissance. It collects the username, hostname, hardware UUID, operating system details, proxy configuration, and external IP address. This profiling data helps attackers uniquely identify compromised machines.
To access browser credential databases, the malware forcibly terminates active browser processes using the TASKKILL command.
It then extracts stored passwords, cookies, autofill entries, and browsing history from Chromium-based browsers.
Master encryption keys are pulled from the Local State file, and credentials are decrypted using AES-GCM. Firefox-based browsers are also targeted through the Network Security Services (NSS) library to decrypt login data from logins.json.
In addition to browser theft, the malware extracts saved Wi-Fi passwords using NETSH, captures Discord authentication tokens, and validates them via the Discord API.
It also collects gaming session files, including data related to Steam and Minecraft, which may allow attackers to hijack accounts without passwords.
CharlieKirk Grabber relies heavily on legitimate Windows utilities, including SYSTEMINFO, WHOAMI, CMD, and PowerShell.
This “living-off-the-land” strategy blends malicious behavior with normal administrative activity, complicating signature-based detection. It also attempts to add Microsoft Defender exclusions using PowerShell if administrative privileges are available.
The malware stages all collected data inside a temporary directory under %LOCALAPPDATA%\Temp, often labeled “KIRK_administrator.” The data is compressed into a ZIP archive before exfiltration.
Exfiltration via Trusted Platforms
For data exfiltration, the malware uploads the archive to a third-party file hosting service such as GoFile. The resulting download link is then transmitted to attacker-controlled infrastructure via Discord webhooks or Telegram bots over HTTPS.
Because communications occur over encrypted TLS channels and abuse legitimate cloud services, network-level detection becomes more difficult.
Dynamic analysis showed no advanced anti-debugging or anti-sandbox techniques.
However, the malware suppresses visible command prompts, runs subprocesses silently, and deletes temporary artifacts after successful upload. In some configurations, it attempts to persist using scheduled task creation at user logon.
Security experts warn that the primary risk is large-scale credential compromise and session hijacking.
Organizations are advised to enforce multi-factor authentication (MFA), restrict browser password storage, monitor for unusual termination of browser processes, and block unauthorized outbound connections to public file-sharing and messaging platforms.
According to Cyfirma, although technically simple, CharlieKirk Grabber demonstrates how commodity Python-based infostealers remain highly effective by abusing legitimate infrastructure and built-in Windows tools to monetize stolen credentials rapidly.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
