Loading malware…
Torg Grabber is a Windows information stealer distributed as Malware-as-a-Service to multiple criminal operators. Identified by Gen Digital, it was initially misidentified as Vidar but is a distinct family with different compilation, encryption, and communication characteristics. Analysis identified 334 samples compiled between December 2025 and February 2026 and more than 40 operator tags. Several operators were linked to the Russian-speaking cybercrime ecosystem.
Torg Grabber steals credentials from 25 Chromium-based browsers and eight Firefox-family browsers, alongside session cookies, payment information, and data from hundreds of browser extensions, including cryptocurrency wallets, password managers, and two-factor authentication tools. It also collects messaging and gaming sessions, VPN configurations, FTP and email client data, screenshots, and sensitive user documents. An injected browser module abuses Chromium Elevation Service interfaces to bypass App-Bound Encryption and recover browser encryption keys. The malware profiles infected systems, including security software, running processes, locale, and virtualization indicators, and can receive and execute additional shellcode in memory.
Distribution uses fake game cheats, cracked software, and ClickFix social engineering, including fake security-update prompts that induce victims to execute PowerShell commands. Its multistage delivery chain employs BITS downloads, encrypted payloads, direct Windows NT system calls, and reflective in-memory loading to hinder detection. Exfiltration evolved from Telegram bots through a short-lived encrypted TCP protocol to an HTTPS REST API using ChaCha20 encryption and HMAC-SHA256 authentication. Operator-specific configuration supports multiple criminal customers sharing the malware framework.
41 distinct techniques documented for this family, organized by ATT&CK tactic.
Imagine visiting a website and seeing a pop up that says your browser needs a security update. It looks official and even includes a progress bar that ticks away for seven minutes.
Torg Grabber does not just break into your house: it tricks you into opening the door. Our team observed a clever tactic called "ClickFix." Imagine visiting a website and seeing a pop up that says your browser needs a security update.
The ClickFix Initial Access ... The victim hits a malicious Google Apps Script page ... The page drops a PowerShell command into the clipboard and tells the victim to paste.
The page silently copies a PowerShell command to the clipboard ... A PowerShell process with -W Hidden -E <base64> ... Invoke-Expression ...
In a confirmed infection from January 30, 2026, a malicious page quietly placed a PowerShell command in the clipboard and told the user to paste and run it.
The malware resolves NT syscall numbers ... parsing ntdll.dll’s export table ... Twenty syscalls wrapped ... allocates executable memory via NtAllocateVirtualMemory.
This triggered a hidden BITS Transfer download that ran through Windows’ own svchost.exe, blending into legitimate system traffic and evading many endpoint tools.
Victims encounter it as fake game cheats, cracked software packages, or ClickFix clipboard attacks hosted on Google Apps Script. In a confirmed infection... a malicious page quietly placed a PowerShell command in the clipboard and told the user to paste and run it.
Fake game cheats ... Cracked software ... Regardless of the lure, the final dropper drops a randomly-named executable into C:\Windows\ ... In the Wild ... Chrome pulls GAPI_Update.exe from Dropbox.
The page silently copies a PowerShell command to the clipboard and tells the user to hit Win+R and paste.
This triggered a hidden BITS Transfer download that ran through Windows’ own svchost.exe, blending into legitimate system traffic and evading many endpoint tools.
The loader resolves those NT APIs at runtime and injects the shellcode into memory using direct syscalls ... Before process injection — ABE bypass, shellcode — the stealer writes the config back to env vars.
The outermost layer changes its face ... three skins of encryption and obfuscation ... Hex decode ... AES-256-CBC decrypt ... Four Cascaded Byte Transforms ... XOR-encrypted triple loader download.
...then resolves Windows NT API calls at runtime using direct syscalls, leaving no visible imports for static analysis tools to detect.
The script runs, then deletes itself. Fileless delivery. No artifact left behind but the memory of the thing.
ChaCha20 encryption, HMAC-SHA256 authentication ... ChaCha20-Poly1305 AEAD encryption ... POST to /api/auth with ChaCha20-encrypted JSON ... shellcode handles ChaCha20-decrypted, zlib-compressed payloads.
At first glance, it appeared to be "Vidar," which is a common and widely understood type of malware. However, as our researchers began to look under the hood, the Vidar costume started to fall apart.
The loader resolves those NT APIs at runtime and injects the shellcode into memory using direct syscalls ... Before process injection — ABE bypass, shellcode — the stealer writes the config back to env vars.
The script runs, then deletes itself ... When the malware detects a CIS locale ... it actively deletes the entire Underground directory.
It processes the payload through custom hex decoding and AES decryption...
This triggered a hidden BITS Transfer download that ran through Windows’ own svchost.exe, blending into legitimate system traffic and evading many endpoint tools.
Before any collection begins, Torg Grabber checks for 46 antivirus signatures across 24 security products to see what defenses are in place.
A PowerShell process with -W Hidden -E <base64> ... Three loaders, executed sequentially with 30–41 second delays. Hidden.
Stage 2 operates entirely in memory as a reflective PE loader, mapping the final stealer payload without writing anything to disk.
Creates a mutex — Local\<MachineGuid> so only one instance runs at a time.
...and grabs session data from Discord, Telegram, and Steam.
It targets credentials from 25 Chromium-based browsers and 8 Firefox-family browsers...
sending along a machine fingerprint – GPU, wallpaper hash, hardware ID, antivirus product ... registration structure ... shipped off to /api/auth along with the machine’s vital statistics.
Profiles the system — ... process list, antivirus ... process termination for killing browsers that have the bad manners to hold file locks.
Reads configuration — GRABBER_* environment variables ... export_config_to_env writes the config back to environment variables so any child process inherits the operator’s settings. | Profiles the system — MachineGuid, GPU, process list, antivirus ... hardware fingerprint, installed software, process list, screenshot, environment variables.
Before any collection begins, Torg Grabber checks for 46 antivirus signatures across 24 security products to see what defenses are in place.
Profiles the system ... CIS locale check ... When the malware detects a CIS locale ... it actively deletes the entire Underground directory.
Creates a mutex — Local\<MachineGuid> so only one instance runs at a time.
Collects data ... screenshot, installed software, Desktop/Documents files ... File grabbing: Pattern-based collection from Desktop and Documents with C2-configurable rules.
VPN configs, FTP client data, and desktop screenshots are also collected.
In a confirmed infection from January 30, 2026, a malicious page quietly placed a PowerShell command in the clipboard and told the user to paste and run it.
grabbed credentials, stuffed them into a ZIP archive ... Exfiltrates — archives to in-memory ZIP or streams chunks ... machine_api builds construct two ZIP archives with distinct folder layout.
Beginning December 18, it transitioned to production-grade REST API over HTTPS routed through Cloudflare, making traffic interception and domain-based blocking far more difficult.
The malware performs a JSON registration at /api/auth ... Then comes the upload: stolen data, chunked over HTTPS ... Each request carries an HMAC-SHA256 X-Auth-Token header.
They built a professional grade system that hides its traffic behind legitimate web services like Cloudflare. This makes their malicious activity look like normal web browsing.
From December 17 to 20, the malware briefly switched to a raw TCP socket protocol using a custom 9-byte binary frame with ChaCha20-Poly1305 encryption.
While the progress bar ticks, a background Start-Job downloads three loaders ... Each file: base64 blob decrypted with a 256-byte repeating XOR key ... Three loaders, executed sequentially.
They created a custom, high speed communication protocol that used advanced military grade encryption.
Phase 2: GRAB Binary TCP Protocol ... the malware opened a raw TCP socket to *.tara.net.bd on port 50443 and spoke a custom binary protocol ... Phase 3: REST API over HTTPS ... stolen data, chunked over HTTPS, ChaCha20-encrypted, routed through Cloudflare.
The earliest builds, active from December 9 to 11, 2025, sent stolen ZIP archives to private Telegram channels through the Telegram Bot API — a fast, zero-infrastructure approach.
Phase 1: Telegram Bot API (Dec 9–11, 2025) ... grabbed credentials, stuffed them into a ZIP archive, and shipped the whole package to a private Telegram channel via sendDocument ... fallback to plaintext sendMessage.
23 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.