Security researchers have uncovered a highly sophisticated information stealer named Torg Grabber, which has rapidly evolved into a formidable Malware-as-a-Service (MaaS) operation.
Originally misclassified as Vidar due to deceptive labeling, the malware is actively developed, with researchers analyzing 334 unique samples compiled over just three months.
Rapid Evolution and Network Infrastructure
Torg Grabber’s development is marked by rapid evolution across three distinct phases to enhance its data exfiltration capabilities.
The earliest builds were rudimentary, relying on simple Telegram bots to ship stolen credentials via unencrypted ZIP archives. Realizing the limitations and detectability of this approach, the developers briefly experimented with a custom TCP protocol secured by ChaCha20 encryption.
Ultimately, the creators abandoned the TCP method in favor of a production-grade REST API over HTTPS. In its final form, the malware registers infected machines using unique hardware fingerprints.
It communicates with its command-and-control (C2) servers using chunked, ChaCha20-encrypted data routed through Cloudflare. To manage its growing criminal customer base, Torg Grabber uses unique operator tags.
These tags, often linked to Russian cybercriminal Telegram accounts, are injected into the malware using environment variables. This franchise model allows a single compiled payload to serve multiple operators seamlessly.
Multi-Stage Loader and Security Evasion
Torg Grabber reaches victims through a complex, fileless infection chain. The initial compromise often stems from deceptive lures like fake game cheats, cracked software, or malicious “ClickFix” clipboard attacks.
Once executed, the initial dropper configures system environment variables to establish the specific operator’s identity.
A self-extracting loader then decodes the subsequent stages, ultimately using a reflective PE loader to execute the final 683 KB stealer payload entirely within the system’s memory.
This technique ensures the core malware never touches the hard drive, making it extremely difficult for traditional antivirus tools to detect.
One of the most dangerous capabilities of Torg Grabber is its ability to bypass Google Chrome’s App-Bound Encryption (ABE).
Introduced to protect gendigital browser data by tying it to the browser’s process identity, ABE is defeated by Torg Grabber using a custom 20 KB encrypted reflective DLL.
This DLL manipulates Windows Elevation Service COM interfaces in browsers such as Chrome, Edge, Brave, and AVG to extract the AES-256 master key.
Once the master key is obtained, the malware unlocks the browser’s local state, stealing passwords, cookies, and sensitive data from hundreds of extensions.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
