Malware

BlackCap Grabber

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1195Supply Chain CompromiseEvidence1

It also follows the discovery of an ongoing “repo confusion” attack targeting GitHub that’s inundating the source code hosting platform with thousands of repositories containing obfuscated malware capable of stealing passwords and cryptocurrency from developer devices.

T1566PhishingEvidence1

“Repo confusion attacks simply rely on humans to mistakenly pick the malicious version over the real one, sometimes employing social engineering techniques as well,”

Execution

1 technique

T1204.002Malicious FileEvidence1

The attacks represent another wave of the same malware distribution campaign that was disclosed by Phylum and Trend Micro last year, leveraging bogus Python packages hosted on the cloned, trojanized repositories to deliver a stealer malware called BlackCap Grabber.

Stealth

1 technique

T1036MasqueradingEvidence1

“Repo confusion attacks simply rely on humans to mistakenly pick the malicious version over the real one, sometimes employing social engineering techniques as well,”

Credential Access

1 technique

T1649Steal or Forge Authentication CertificatesEvidence1

repositories containing obfuscated malware capable of stealing passwords and cryptocurrency from developer devices.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

trellix blogNews

May 19, 2026

Skuld: The Infostealer that Speaks Golang

An open-source grabber referenced as inspiration for Skuld's BetterDiscord and Discord Token Protector bypass methods.

sophos threat researchNews

Jan 1, 2026

The strange tale of ischhfd83: When cybercriminals eat their own – Sophos News | SOPHOS

An information stealer mentioned in prior related GitHub backdoor campaigns.

sophos threat researchNews

Jan 1, 2026

The strange tale of ischhfd83: When cybercriminals eat their own – Sophos News | SOPHOS

An information stealer mentioned as the final payload in a related GitHub backdoor campaign.

the hacker newsNews

Mar 1, 2024

GitHub Rolls Out Default Secret Scanning Push Protection for Public Repositories

A stealer malware delivered via bogus Python packages in cloned, trojanized GitHub repositories, capable of stealing passwords and cryptocurrency from developer devices.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

BlackCap Grabber

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1195Supply Chain CompromiseEvidence1

T1566PhishingEvidence1

“Repo confusion attacks simply rely on humans to mistakenly pick the malicious version over the real one, sometimes employing social engineering techniques as well,”

Execution

1 technique

T1204.002Malicious FileEvidence1

Stealth

1 technique

T1036MasqueradingEvidence1

“Repo confusion attacks simply rely on humans to mistakenly pick the malicious version over the real one, sometimes employing social engineering techniques as well,”

Credential Access

1 technique

T1649Steal or Forge Authentication CertificatesEvidence1

repositories containing obfuscated malware capable of stealing passwords and cryptocurrency from developer devices.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

trellix blogNews

May 19, 2026

Skuld: The Infostealer that Speaks Golang

An open-source grabber referenced as inspiration for Skuld's BetterDiscord and Discord Token Protector bypass methods.

sophos threat researchNews

Jan 1, 2026

The strange tale of ischhfd83: When cybercriminals eat their own – Sophos News | SOPHOS

An information stealer mentioned in prior related GitHub backdoor campaigns.

sophos threat researchNews

Jan 1, 2026

The strange tale of ischhfd83: When cybercriminals eat their own – Sophos News | SOPHOS

An information stealer mentioned as the final payload in a related GitHub backdoor campaign.

the hacker newsNews

Mar 1, 2024

GitHub Rolls Out Default Secret Scanning Push Protection for Public Repositories

A stealer malware delivered via bogus Python packages in cloned, trojanized GitHub repositories, capable of stealing passwords and cryptocurrency from developer devices.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.