Torg Grabber Steals Data from 728 Crypto Wallet Extensions
Summary
Gen Digital researchers say Torg Grabber uses ClickFix to steal data from 850 browser extensions, including 728 crypto-wallet extensions. Their analysis documents 334 samples, evolving exfiltration and evasion methods, and a separate Chrome key-extraction tool.
Key points
- Gen Digital researchers recorded 334 unique Torg Grabber samples compiled between December 2025 and February 2026, with new C2 servers registered weekly.
- The malware targets 850 browser extensions, including 728 for cryptocurrency wallets, as well as password managers, authentication tools, note-taking apps, and desktop wallet apps.
- The reported initial-access method is ClickFix, which hijacks the clipboard to trick users into running a malicious PowerShell command.
- Torg Grabber uses multi-layer obfuscation, direct syscalls, reflective loading, in-memory execution, and an App-Bound Encryption bypass affecting several Chromium-based browsers.
- Researchers say exfiltration shifted from Telegram and custom encrypted TCP to HTTPS routed through Cloudflare, supporting chunked uploads and payload delivery.
- A separate tool called Underground reportedly injects a DLL into the browser to access Chrome’s COM Elevation Service and extract the master encryption key.
- The malware can steal credentials, cookies, autofill data, and files; profile hosts, take screenshots, and execute C2-delivered shellcode.
Article Details
- Attack Vectors
- ClickFix clipboard hijacking tricks users into executing a malicious PowerShell command.
- Torg Grabber harvests credentials, cookies, autofill data, and cryptocurrency wallet information from browsers and extensions.
- The malware uploads stolen data over HTTPS routed through Cloudflare infrastructure and can receive payloads from its C2.
- Underground reflectively injects a DLL into a browser to access Chrome’s COM Elevation Service and extract the master encryption key.
- Torg Grabber can steal files from Desktop and Documents folders, take screenshots, and execute shellcode delivered in ChaCha-encrypted, zlib-compressed form.
MITRE ATT&CK
T1005 · Data from Local SystemTorg Grabber steals files from the Desktop and Documents folders.T1027 · Obfuscated Files or InformationThe malware uses multi-layered obfuscation to evade analysis and detection.T1041 · Exfiltration Over C2 ChannelTorg Grabber uploads collected data through its HTTPS C2 connection.T1059.001 · PowerShellThe ClickFix lure directs users to execute a malicious PowerShell command.T1071.001 · Web ProtocolsThe malware shifted its exfiltration to HTTPS routed through Cloudflare infrastructure.T1082 · System Information DiscoveryThe malware profiles the host and creates a hardware fingerprint.T1105 · Ingress Tool TransferThe article reports that the HTTPS method supports payload delivery from the C2.T1113 · Screen CaptureTorg Grabber can take screenshots of the compromised user’s desktop.T1204 · User ExecutionThe initial-access chain depends on users executing the command presented through the ClickFix clipboard-hijack trick.T1518.001 · Security Software DiscoveryTorg Grabber documents installed software, including antivirus tools.T1539 · Steal Web Session CookieTorg Grabber targets browser cookies, including by bypassing App-Bound Encryption protections.T1555.003 · Credentials from Web BrowsersTorg Grabber targets browser credentials and uses an App-Bound Encryption bypass to access protected browser data.T1620 · Reflective Code LoadingUnderground reflectively loads a DLL into a browser to extract Chrome’s master encryption key.
Malware
Torg GrabberTorg Grabber is a rapidly evolving info-stealer that harvests sensitive data from 850 browser extensions — including 728 dedicated to cryptocurrency wallets — and also targets password managers, 2FA tools, note-takingVoidStealerIt injects a DLL reflectively into the browser to access Chrome’s COM Elevation Service and extract the master encryption key, a method also recently seen in VoidStealer.
Vendors
Products
BraveOn December 22, 2025, Torg Grabber added App-Bound Encryption (ABE) bypass to beat Chrome’s (and Brave’s, Edge’s, Vivaldi’s, and Opera’s) cookie protection system, like many other information stealers.EdgeOn December 22, 2025, Torg Grabber added App-Bound Encryption (ABE) bypass to beat Chrome’s (and Brave’s, Edge’s, Vivaldi’s, and Opera’s) cookie protection system, like many other information stealers.Google ChromeC2 domains, advanced evasion techniques, and a standalone extraction tool called Underground that abuses Chrome’s COM Elevation Service.Mozilla FirefoxGen Digital found that Torg Grabber targets 25 Chromium-based browsers and 8 Firefox variants, trying to steal credentials, cookies, and autofill data.OperaOn December 22, 2025, Torg Grabber added App-Bound Encryption (ABE) bypass to beat Chrome’s (and Brave’s, Edge’s, Vivaldi’s, and Opera’s) cookie protection system, like many other information stealers.VivaldiOn December 22, 2025, Torg Grabber added App-Bound Encryption (ABE) bypass to beat Chrome’s (and Brave’s, Edge’s, Vivaldi’s, and Opera’s) cookie protection system, like many other information stealers.
Tools
PowerShellInitial access is gained via the ClickFix clipboard-hijack trick that lures users into running a malicious PowerShell command.Undergroundweekly-registered C2 domains, advanced evasion techniques, and a standalone extraction tool called Underground that abuses Chrome’s COM Elevation Service.