Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Malware

BoryptGrab

BoryptGrab is an information stealer targeting Windows users. Trend Micro reported it was distributed through a large campaign abusing more than 100 public GitHub repositories, with ZIP archives masquerading as legitimate software tools, utilities, and game cheats. The operation used SEO-stuffed GitHub README files and deceptive GitHub Pages-style download sites, including a Voicemod Pro lure, to drive victims through redirect chains to fake download pages that generated malicious ZIP archives. Proton66 OOO infrastructure was also linked to a BoryptGrab infostealer operation abusing over 100 public GitHub repositories through SEO manipulation.

The malware is described as a C/C++ stealer that performs anti-analysis checks, including querying registry entries, checking VM-related files, comparing running process names against a predefined list, and attempting to execute with elevated privileges. Infection chains observed in the reporting include DLL sideloading via a malicious libcurl.dll, VBS downloaders that decode hidden PowerShell commands, and .NET loaders. Launchers can download BoryptGrab and additional payloads, pass build names such as Shrek, Leon, and CryptoByte via a "-b" argument, and establish persistence through scheduled tasks. Some related delivery chains also used HeaconLoad, a Golang downloader that maintains persistence via registry entries and scheduled tasks and downloads additional bundles.

BoryptGrab collects extensive data from infected systems. Reported targets include browser data from Chrome, Edge, Firefox, Opera, Brave, Vivaldi, and Yandex; cryptocurrency wallet data from Exodus, Electrum, Ledger Live, Atomic, Binance, Wasabi, and Trezor; system details; screenshots; Telegram files; common files with specific extensions from common directories; and, in newer variants, Discord tokens. The malware uses techniques from public GitHub tools to bypass Chrome App-Bound Encryption and decrypt stored browser credentials. It supports command-line arguments including "--output-path"/"-o" and "--build-name"; if no output path is provided, it creates a staging directory name based on the current time, public IP address, and country code. After collection, it compresses stolen data and uploads the archive to attacker-controlled infrastructure.

Associated payloads observed alongside BoryptGrab include Vidar variants, HeaconLoad, and TunnesshClient, a PyInstaller backdoor that creates a reverse SSH tunnel enabling remote command execution, file movement, and proxying through the infected host. Reporting cited Russian-language comments and infrastructure artifacts as suggesting the operators may be of Russian origin.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques
T1608.001Upload MalwareEvidence1

They stuff README files with SEO keywords so search engines rank the malicious repositories near legitimate results.

T1608.006SEO PoisoningEvidence1

Proton66 OOO infrastructure was separately connected to a BoryptGrab infostealer operation abusing over 100 public GitHub repositories through SEO manipulation.

Execution

4 techniques
T1053.005Scheduled TaskEvidence1

...sets scheduled tasks to keep the malware running.

T1059.001PowerShellEvidence1

The script decodes PowerShell commands, downloads a launcher from a remote server...

T1059.005Visual BasicEvidence1

Another infection path uses a VBS downloader that hides commands inside integer arrays. The script decodes PowerShell commands, downloads a launcher from a remote server...

T1204User ExecutionEvidence1

“New BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages”

Persistence

1 technique
T1053.005Scheduled TaskEvidence1

...sets scheduled tasks to keep the malware running.

Privilege Escalation

3 techniques
T1053.005Scheduled TaskEvidence1

...sets scheduled tasks to keep the malware running.

T1055Process InjectionEvidence1

...obfuscation techniques such as XOR-encrypted strings, dynamic API resolution, and code injection.

T1548Abuse Elevation Control MechanismEvidence1

It also attempts to execute with elevated privilege.

Stealth

3 techniques
T1027Obfuscated Files or InformationEvidence1

Several payloads rely on obfuscation techniques such as XOR-encrypted strings, dynamic API resolution, and code injection.

T1055Process InjectionEvidence1

...obfuscation techniques such as XOR-encrypted strings, dynamic API resolution, and code injection.

T1497Virtualization/Sandbox EvasionEvidence1

BoryptGrab detects whether it is executed in a virtual machine environment by querying registry entries and checking VM-related files.

Credential Access

2 techniques
T1552Unsecured CredentialsEvidence1

Beyond browser data, it steals information from numerous desktop cryptocurrency wallets such as Exodus, Electrum, Ledger Live...

T1555.003Credentials from Web BrowsersEvidence1

...extracts saved passwords... uses techniques... to bypass Chrome’s App-Bound Encryption and decrypt stored browser credentials.

Discovery

3 techniques
T1057Process DiscoveryEvidence1

...compares the names of running processes against a predefined list.

T1082System Information DiscoveryEvidence1

...stealing browser data, crypto wallets, system information... gathers system details... records installed applications.

T1497Virtualization/Sandbox EvasionEvidence1

BoryptGrab detects whether it is executed in a virtual machine environment by querying registry entries and checking VM-related files.

Collection

3 techniques
T1005Data from Local SystemEvidence1

...includes a “file grabber” module that collects files with specific extensions from common directories. | The malware also extracts Telegram files... and in newer variants, Discord tokens.

T1113Screen CaptureEvidence1

It captures screenshots...

T1560Archive Collected DataEvidence1

After gathering the data, BoryptGrab compresses and uploads the archive to the attacker’s server.

Command and Control

2 techniques
T1071Application Layer ProtocolEvidence2

Over a three-month window from January 1 to April 1, 2026, more than 1,250 active command-and-control (C2) servers were detected across 165 Russian infrastructure providers.

T1105Ingress Tool TransferEvidence2

The launcher downloads the BoryptGrab information stealer and may also retrieve other payloads, including Vidar variants... and a Golang downloader named HeaconLoad.

Exfiltration

1 technique
T1041Exfiltration Over C2 ChannelEvidence1

After gathering the data, BoryptGrab compresses and uploads the archive to the attacker’s server.

Other

1 technique
T1562.001Disable or Modify ToolsEvidence1

...can even add Microsoft Defender exclusions to avoid detection.

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.