Torg Grabber infostealer hits 728 crypto wallets and 103 password managers

Gen Digital has documented Torg Grabber, a fast-moving Windows infostealer that goes after 850 browser extensions, including 728 crypto wallets and 103 password-manager and 2FA extensions. It gets in through ClickFix, a social-engineering trick that has users paste a PowerShell command themselves. Developer workstations are a prime target: they hold browser sessions for GitHub, cloud consoles and package registries, and often wallets and password vaults too.

What happened

On 24 March 2026 Gen Digital (the company behind Norton, Avast and AVG) published a write-up and full technical report on Torg Grabber by Luis Corrons and Gen's researchers. They tracked 334 unique samples compiled between December 2025 and February 2026, with more than 40 operator tags linked to Russian-speaking cybercrime actors. BleepingComputer reported that new C2 servers were registered roughly every week.

Exfiltration changed quickly over that period:

• Early December 2025: stolen data was sent as ZIPs through Telegram bots.
• December 2025: an experimental custom TCP protocol on port 50443 with ChaCha20-Poly1305, dropped after four builds.
• From 22 December 2025: a "production" REST API over HTTPS behind Cloudflare, with ChaCha20-encrypted chunked uploads and an HMAC-signed X-Auth-Token header, sold as malware-as-a-service.

Who is affected

• Windows users lured by fake "security update" prompts, game cheats or cracked software.
• Anyone with browser-based secrets. Targets include 25 Chromium-based and 8 Firefox-family browsers, 850 extensions (728 wallets, 103 password managers and authenticators, of which 31 are 2FA, plus 19 note-taking apps), 30+ desktop wallets, Discord tokens, Telegram sessions, Steam configs, VPN and FTP clients, and files on the Desktop and in Documents.
• Organisations whose staff use personal or unmanaged machines for work SaaS. Stolen session cookies let attackers skip passwords and often MFA.

What it means for developers and engineering teams

ClickFix beats download controls. In the chain Gen observed on 30 January 2026, a Google Apps Script page copied a PowerShell command to the clipboard and told the victim to paste it into the Run dialog. That launched hidden PowerShell (-W Hidden -E <base64>), which used BITS to fetch a stager. A fake "Windows Security Update" progress bar ran for about seven minutes while three XOR-encrypted loaders downloaded in the background. The user ran it, so mark-of-the-web and download warnings never came into play.

App-Bound Encryption is not a full defence. Chrome 127 added App-Bound Encryption so other processes can't simply decrypt cookies and saved passwords. Torg Grabber injects a roughly 20 KB reflective DLL into the browser and calls the browser's own IElevator COM interface to recover the AES master key. It covers Chrome, Edge, Brave, Vivaldi, Opera, Avast and AVG browsers. Malware running as the user can still get the browser to decrypt on its behalf.

Session cookies are the real prize. A stolen session for GitHub, AWS, npm or your CI system often skips MFA entirely. For engineering teams the impact of one infected laptop is less "my passwords leaked" and more "someone can push code or read prod secrets as me until the session expires."

What to do now

1. Block the ClickFix pattern. On managed Windows, disable the Run dialog for standard users where practical, use PowerShell Constrained Language Mode, and alert on explorer.exe spawning powershell.exe with -EncodedCommand or hidden windows.
2. Detect the documented behaviours: PowerShell calling Start-BitsTransfer, csc.exe compiling from Add-Type, attempts to disable ETW, and files under C:\ProgramData\Underground\ or %LOCALAPPDATA%\Connector\.
3. Shorten session lifetimes for code hosts, cloud consoles and registries, and bind sessions to devices where the platform supports it.
4. Keep secrets out of browser storage. Store CLI tokens in OS keychains or short-lived credentials via SSO/OIDC, not in browser-saved passwords or notes files on the Desktop.
5. Use hardware wallets for significant crypto holdings, and never keep seed phrases in notes apps or text files.
6. If infected: wipe and reimage, then from a clean device revoke all sessions and rotate passwords, API tokens, SSH keys and 2FA seeds. Move any wallet funds to new keys.
7. Load IOCs from Gen's technical report and its GitHub repository into your EDR and DNS filtering. Expect them to go stale fast, since domains rotate roughly every ten days.

Related on TechLogHub

• Authentication: sessions, cookies and why stolen ones skip MFA
• JWT: token lifetimes and revocation

Sources

• Gen Digital: How we unmasked Torg Grabber (24 March 2026)
• Gen Digital: Torg Grabber credential stealer technical analysis
• BleepingComputer: New Torg Grabber infostealer malware targets 728 crypto wallets