Loading malware…
Torg Grabber is a newly identified Malware-as-a-Service infostealer/credential stealer first reported by Gen Digital after samples were initially mislabeled as Vidar. Researchers analyzed 334 samples compiled over roughly three months from December 2025 through February 2026 and assessed it as a builder-based criminal operation serving multiple customers, with more than 40 distinct operator tags embedded in samples. Several operator tags were linked via OSINT to Telegram accounts in the Russian-speaking cybercrime ecosystem. The malware name derives from the frequently used C2 domain technologytorg.com.
Torg Grabber rapidly evolved through three exfiltration/C2 phases: an early Telegram Bot API phase active around 2025-12-09 to 2025-12-11 that sent stolen ZIP archives to private Telegram channels; a short-lived custom raw TCP "GRAB" protocol phase around 2025-12-17 to 2025-12-20 using a 9-byte frame format with ChaCha20-Poly1305 and HMAC-SHA256-derived keys; and a production REST API phase beginning 2025-12-18 using HTTPS, often behind Cloudflare, with ChaCha20 encryption and HMAC-SHA256 authentication. Reported REST endpoints included /api/auth and /api/upload/chunk, and related backend activity also used /api/machine/set-files-r.
Delivery is via a multi-stage loader chain associated with fake game cheats, cracked software, and ClickFix clipboard attacks, including Google Apps Script-hosted lures. In observed infections, victims were socially engineered into pasting and running malicious PowerShell, which triggered hidden BITS downloads executed via svchost.exe. The chain included a Stage 0 dropper, a self-extracting Stage 1 loader with an AES-256-CBC encrypted overlay, a Stage 2 reflective PE loader operating entirely in memory, and the final 64-bit MinGW/GCC-compiled stealer payload. The malware uses direct NT syscall resolution and reflective loading to reduce static visibility and avoid writing the final payload to disk.
Capabilities center on broad information theft. Torg Grabber targets credentials from 25 Chromium-based browsers and 8 Firefox-family browsers, steals session data from Discord, Telegram, and Steam, and collects VPN configurations, FTP client data, email client data, password manager data, installed software information, screenshots, and files from Desktop and Documents. It targets more than 850 browser extensions, including 728 cryptocurrency wallet extensions and 103 password manager and two-factor authentication tools. It also profiles the victim system, including GPU, antivirus, process list, locale, virtualization indicators, and uses a mutex derived from MachineGuid.
A notable capability is bypass of Chromium App-Bound Encryption (ABE). Torg Grabber includes a reflective DLL of about 19,968 bytes / roughly 20 KB that abuses Chromium Elevation Service COM interfaces to extract browser master keys and decrypt protected browser data. Reported support included Chrome, Edge, Brave, Avast, AVG, Vivaldi, and Opera. Corpus analysis found 109 samples with the ABE bypass; earlier builds instead harvested credentials from C:\ProgramData\Underground, and no sample reportedly contained both features. The first ABE-capable build appeared on 2025-12-22.
The malware also supports post-exploitation by receiving ChaCha20-encrypted, zlib-compressed shellcode from C2 and executing it in memory. Before collection, it checks for 46 antivirus signatures across 24 security products.
Infrastructure reported in connection with Torg Grabber included 18 C2 domains such as technologytorg.com, gogenbydet.cc, evasivestars.com, bbcplay.top, playbergs.info, attackzombie.com, safeguss.com, si-dodgei.digital, and wulingyuanparkzone.com. Additional related domains included quick-neo.com and 50elk.com. In one documented January 30, 2026 infection chain, staging and delivery involved j0o.pw, t4e.pw, re3.pw, Dropbox-hosted GAPI_Update.exe, and final C2 at si-dodgei.digital. Early Telegram-phase artifacts exposed bot accounts including @trtest12bot and creator accounts including @ChaChaGuru and @OneCC_team.
Torg Grabber has been reported in finance-sector incident tracking as an infostealer associated with cryptocurrency wallet targeting.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
40 distinct techniques documented for this family, organized by ATT&CK tactic.
The page silently copies a PowerShell command to the clipboard ... A PowerShell process with -W Hidden -E <base64> ... Invoke-Expression ...
In a confirmed infection from January 30, 2026, a malicious page quietly placed a PowerShell command in the clipboard and told the user to paste and run it.
The malware resolves NT syscall numbers ... parsing ntdll.dll’s export table ... Twenty syscalls wrapped ... allocates executable memory via NtAllocateVirtualMemory.
This triggered a hidden BITS Transfer download that ran through Windows’ own svchost.exe, blending into legitimate system traffic and evading many endpoint tools.
Victims encounter it as fake game cheats, cracked software packages, or ClickFix clipboard attacks hosted on Google Apps Script. In a confirmed infection... a malicious page quietly placed a PowerShell command in the clipboard and told the user to paste and run it.
The outermost layer changes its face ... three skins of encryption and obfuscation ... Hex decode ... AES-256-CBC decrypt ... Four Cascaded Byte Transforms ... XOR-encrypted triple loader download.
...then resolves Windows NT API calls at runtime using direct syscalls, leaving no visible imports for static analysis tools to detect.
The script runs, then deletes itself. Fileless delivery. No artifact left behind but the memory of the thing.
ChaCha20 encryption, HMAC-SHA256 authentication ... ChaCha20-Poly1305 AEAD encryption ... POST to /api/auth with ChaCha20-encrypted JSON ... shellcode handles ChaCha20-decrypted, zlib-compressed payloads.
At first glance, it appeared to be "Vidar," which is a common and widely understood type of malware. However, as our researchers began to look under the hood, the Vidar costume started to fall apart.
The loader resolves those NT APIs at runtime and injects the shellcode into memory using direct syscalls ... Before process injection — ABE bypass, shellcode — the stealer writes the config back to env vars.
The script runs, then deletes itself ... When the malware detects a CIS locale ... it actively deletes the entire Underground directory.
It processes the payload through custom hex decoding and AES decryption...
This triggered a hidden BITS Transfer download that ran through Windows’ own svchost.exe, blending into legitimate system traffic and evading many endpoint tools.
Before any collection begins, Torg Grabber checks for 46 antivirus signatures across 24 security products to see what defenses are in place.
A PowerShell process with -W Hidden -E <base64> ... Three loaders, executed sequentially with 30–41 second delays. Hidden.
sending along a machine fingerprint – GPU, wallpaper hash, hardware ID, antivirus product ... registration structure ... shipped off to /api/auth along with the machine’s vital statistics.
Profiles the system — ... process list, antivirus ... process termination for killing browsers that have the bad manners to hold file locks.
Reads configuration — GRABBER_* environment variables ... export_config_to_env writes the config back to environment variables so any child process inherits the operator’s settings. | Profiles the system — MachineGuid, GPU, process list, antivirus ... hardware fingerprint, installed software, process list, screenshot, environment variables.
Before any collection begins, Torg Grabber checks for 46 antivirus signatures across 24 security products to see what defenses are in place.
Collects data ... screenshot, installed software, Desktop/Documents files ... File grabbing: Pattern-based collection from Desktop and Documents with C2-configurable rules.
VPN configs, FTP client data, and desktop screenshots are also collected.
Beginning December 18, it transitioned to production-grade REST API over HTTPS routed through Cloudflare, making traffic interception and domain-based blocking far more difficult.
The malware performs a JSON registration at /api/auth ... Then comes the upload: stolen data, chunked over HTTPS ... Each request carries an HMAC-SHA256 X-Auth-Token header.
They built a professional grade system that hides its traffic behind legitimate web services like Cloudflare. This makes their malicious activity look like normal web browsing.
From December 17 to 20, the malware briefly switched to a raw TCP socket protocol using a custom 9-byte binary frame with ChaCha20-Poly1305 encryption.
Phase 2: GRAB Binary TCP Protocol ... the malware opened a raw TCP socket to *.tara.net.bd on port 50443 and spoke a custom binary protocol ... Phase 3: REST API over HTTPS ... stolen data, chunked over HTTPS, ChaCha20-encrypted, routed through Cloudflare.
23 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced only as a comparison family that did not technically match the observed sample.
An infostealer associated with theft from 728 crypto wallets.
Torg Grabber is a malware-as-a-service credential stealer that rapidly evolved from Telegram-based exfiltration to an encrypted REST API C2 infrastructure. It steals credentials and session data from numerous browsers, browser extensions, cryptocurrency wallets, 2FA tools, Discord, Telegram, Steam, VPN configs, FTP client data, and desktop screenshots. It also checks for installed antivirus products and is delivered through a multi-stage in-memory loader chain using droppers, PowerShell, BITS Transfer, AES-encrypted loaders, direct syscalls, and reflective PE loading.
Torg Grabber is a newly identified infostealer that disguises itself as Vidar to evade scrutiny. It evolved rapidly into a Malware-as-a-Service operation, uses social engineering via ClickFix and fake updates/software lures for delivery, hides traffic behind legitimate services like Cloudflare, and includes a custom mechanism to bypass browser App-Bound Encryption to steal passwords, credit card data, session cookies, cryptocurrency wallets, password manager data, and other sensitive files.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.