New Windows Infostealer Targets 17 Browsers to Steal Passwords and Credit Cards

Security researchers have uncovered a Python-based Windows infostealer distributed through a suspicious nested archive. The malware targets credentials, payment-card details, browser cookies, Wi-Fi passwords, Discord tokens, Roblox session cookies, and victim system information.

The initial file, named my new program called 2.rar, contains a ZIP archive called TokenGrabberBuilder.zip. Inside is a “TokenGrabber Builder” folder with a Python-based builder and an embedded credential-stealing payload.

The builder follows a Malware-as-a-Service (MaaS) approach, allowing operators to generate customized malware executables with attacker-controlled webhook settings.

Windows Infostealer Targets Browsers

The builder installs required Python dependencies automatically, helping it run even on systems without a prepared development environment.

It also stores the configured webhook in a local webhook.txt file, allowing attackers to reuse the same data-exfiltration endpoint during future builds.

Before adding the webhook to the payload, the builder encrypts it using XOR with the 0x5A key and then Base64-encodes it. This prevents the URL from appearing in plaintext and creates different malware samples when a different webhook is configured.

Operators can compile the payload with Nuitka or PyInstaller, or save it as a raw Python script. Nuitka is especially concerning because it converts Python code into native binaries, making Python bytecode recovery more difficult.

PyInstaller packages the Python interpreter and code into a single executable, while the raw-script option enables further manual modification.

The malware also searches for Python installations across environment paths, common folders, and Windows Registry locations. This helps the builder work across different Windows systems.

The payload uses obfuscation, anti-analysis checks, persistence, credential theft, and webhook-based exfiltration. It decodes sensitive strings only during execution and dynamically loads libraries when needed, reducing visible indicators during startup.

To avoid security researchers and sandbox environments, the malware checks for attached debuggers, virtualization-related processes, and disks smaller than 50 GB. It also uses variable sleep periods to delay activity.

For persistence, the stealer creates a Registry Run key at HKCU\Software\Microsoft\Windows\CurrentVersion\Run using the misleading name WindowsUpdate. It also creates a scheduled task that launches at user logon.

The malware targets 17 Chromium-based browsers. It accesses the Login Data, History, Web Data, and Cookies databases to steal saved usernames, passwords, browsing history, credit-card details, and active session cookies.

It decrypts browser credentials by recovering encryption keys from the browser’s Local State file through Windows DPAPI.

Firefox users are also at risk. The malware collects browsing data from Firefox profile databases, including places.sqlite and cookies.sqlite, k7computing said.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team