Ethical Hacking News

New Torg Grabber Malware Steals Sensitive Data from 850 Browser Extensions

New Torg Grabber is a highly sophisticated malware campaign that targets 850 browser extensions across multiple platforms, with over 728 of them specifically designed for cryptocurrency wallets. The malware steals sensitive data from these wallets and other storage solutions, including credentials, cookies, and autofill data. Gen Digital researchers have identified several anti-analysis mechanisms, multi-layered obfuscation, and uses direct syscalls and reflective loading for evasion, running the final payload entirely in memory.

Torg Grabber is a highly sophisticated malware campaign targeting cryptocurrency wallets and sensitive data storage solutions.

The malware uses the ClickFix technique to hijack the clipboard and trick users into executing a malicious PowerShell command.

Torg Grabber can steal credentials, cookies, and autofill data from cryptocurrency wallets and over 103 extensions for passwords, tokens, and authenticators.

The malware has added App-Bound Encryption (ABE) bypass to beat Chrome's cookie protection system.

Gen Digital warns that Torg Grabber continues to develop rapidly, with new C2 domains registered weekly.

Users and organizations must implement robust security measures, stay informed about emerging threats, and utilize reputable antivirus software to protect against Torg Grabber.

The cybersecurity landscape has recently been hit by a new and highly sophisticated malware campaign known as New Torg Grabber, which has been making headlines for its aggressive targeting of cryptocurrency wallets and other sensitive data storage solutions. According to researchers at Gen Digital, this malicious actor is actively developing the malware, with 334 unique samples compiled in just three months (between December 2025 and February 2026) and new command-and-control (C2) servers registered every week.

The primary entry point for Torg Grabber is through the ClickFix technique, which involves hijacking the clipboard and tricking users into executing a malicious PowerShell command. Once inside, the malware injects a DLL reflectively into the browser to access Chrome’s COM Elevation Service and extract the master encryption key, a method also recently seen in VoidStealer. This allows it to bypass various security measures, including Chrome's cookie protection system.

Torg Grabber targets 850 browser extensions across 25 Chromium-based browsers and 8 Firefox variants, with over 728 of them specifically designed for cryptocurrency wallets, covering "essentially every crypto wallet ever conceived by human optimism." The malware can steal credentials, cookies, and autofill data from these wallets, including popular names like MetaMask, Phantom, TrustWallet, Coinbase, Binance, Exodus, TronLink, Ronin, OKX, Keplr, Rabby, Sui, Solflare.

Apart from cryptocurrency wallets, Torg Grabber also targets a large list of 103 extensions for passwords, tokens, and authenticators: LastPass, 1Password, Bitwarden, KeePass, NordPass, Dashlane, ProtonPass, Enpass, Psono, Pleasant Password Server, heylogin, 2FAAuth, GAuth, TOTP Authenticator, and Akamai MFA. The malware can also profile the host, create a hardware fingerprint, document installed software (including 24 antivirus tools), take screenshots of the user’s desktop, and steal files from the Desktop/Documents folders.

Furthermore, Torg Grabber has added App-Bound Encryption (ABE) bypass to beat Chrome’s (and Brave's, Edge's, Vivaldi's, and Opera's) cookie protection system, a method also recently seen in other information stealers. The malware features several anti-analysis mechanisms, multi-layered obfuscation, and uses direct syscalls and reflective loading for evasion, running the final payload entirely in memory.

Gen Digital cautions that Torg Grabber continues to develop rapidly, registering new C2 domains weekly, and that its operator base is expanding, with 40 tags documented by the time of analysis. The researchers also discovered a standalone tool called Underground, which uses a similar approach but focuses more on extracting browser data.

The recent development and deployment of New Torg Grabber highlight the evolving nature of malware threats in the digital landscape. As security measures become increasingly sophisticated, attackers continually adapt and innovate to stay ahead. It is crucial for users and organizations to remain vigilant and adopt proactive strategies to protect against such threats.

In response to this new threat, cybersecurity professionals and individuals must be aware of the risks associated with New Torg Grabber and take immediate action to secure their systems and data. This includes implementing robust security measures, staying informed about emerging threats, and utilizing reputable antivirus software to detect and remove malware.

Furthermore, users should exercise extreme caution when interacting with unfamiliar software or websites, avoiding suspicious links and attachments, and regularly updating their operating systems and applications to ensure they have the latest security patches.

As the cybersecurity landscape continues to evolve, it is essential for individuals and organizations to remain proactive in protecting themselves against threats like New Torg Grabber. By staying informed, adopting robust security measures, and utilizing reputable antivirus software, users can significantly reduce their risk of falling victim to this or other similar malware campaigns.

Related Information:

Today's cybersecurity headlines are brought to you by ThreatPerspective

New Torg Grabber Malware Steals Sensitive Data from 850 Browser Extensions