Torg Grabber - New Infostealer Targets 728 Crypto Wallets

What Happened

A new infostealer malware named Torg Grabber has emerged, targeting sensitive data from 850 browser extensions, with a staggering 728 of these extensions dedicated to cryptocurrency wallets. The malware gains initial access using a technique called ClickFix, which hijacks the clipboard and tricks users into executing a malicious PowerShell command. Researchers from Gen Digital report that Torg Grabber is actively developed, with 334 unique samples compiled in just three months, indicating a rapid evolution in its capabilities.

The malware's development has seen a shift in its communication methods. Initially, it used a Telegram-based system for data exfiltration, but this was replaced with an HTTPS connection routed through Cloudflare infrastructure. This change allows for chunked data uploads and payload delivery, enhancing its stealth and effectiveness.

Who's Being Targeted

Torg Grabber is particularly dangerous for cryptocurrency users. It targets 25 Chromium-based browsers and 8 Firefox variants, attempting to steal credentials, cookies, and autofill data. Some of the most popular wallets targeted include MetaMask, TrustWallet, and Coinbase. The malware's reach extends to 103 password managers and various other applications, including Discord, Telegram, and Steam.

The sheer number of extensions affected means that many users may not even be aware that their wallets are at risk. The malware's ability to infiltrate a wide array of applications makes it a significant threat to anyone involved in cryptocurrency transactions.

Signs of Infection

Users should be vigilant for signs of infection from Torg Grabber. The malware can create a hardware fingerprint, take screenshots, and even execute shellcode on compromised devices. It also documents installed software, including antivirus tools, which indicates its sophisticated evasion techniques. If you notice unusual activity in your cryptocurrency wallets or password managers, it may be a sign of Torg Grabber's presence.

How to Protect Yourself

To safeguard against Torg Grabber, users should take proactive measures:

• Update your software regularly to patch vulnerabilities.
• Use multi-factor authentication for your cryptocurrency wallets and sensitive accounts.
• Monitor your accounts for unauthorized transactions or changes.
• Educate yourself about phishing techniques to avoid falling victim to ClickFix or similar methods.

Staying informed and vigilant is key to protecting your digital assets from evolving threats like Torg Grabber.