A new malware, Torg Grabber, is designed to steal information from 850 browser extensions, with a focus on cryptocurrency wallet extensions (over 700).

The malware gains initial access through the ClickFix technique, manipulating the clipboard to trick users into running a harmful PowerShell command.

Cybersecurity experts at Gen Digital report that Torg Grabber is under constant development, with over 300 unique versions appearing in a three-month period (between December 2025 and February 2026), and new command servers appearing weekly.

Besides targeting cryptocurrency wallets, the malware also steals data from over 100 password management tools, two-factor authentication tools, and almost 20 note-taking applications.

A new report from Gen Digital this week says that the earlier versions of Torg Grabber used Telegram and a custom TCP protocol to send stolen data.

On December 18, 2025, these methods were replaced with an HTTPS connection through Cloudflare. This new system supports uploading data in chunks and delivering payloads.

The malware is protected by anti-analysis features, complex obfuscation, and uses special system calls and reflective loading for hiding its activity, running the main part of the malware entirely in the device’s memory.

On December 22, 2025, Torg Grabber could bypass App-Bound Encryption (ABE) to steal cookies from Chrome (and other browsers), a trick also used by other information stealers to bypass security measures.

The researchers also found a separate tool called Underground, used for stealing browser data.

This tool injects a DLL into the browser to access Chrome’s COM Elevation Service and steal the master encryption key, a technique recently observed in VoidStealer.

Gen Digital discovered that Torg Grabber targets about 25 Chromium-based browsers and several Firefox versions, in an effort to steal logins, cookies, and autofill information.

Of the 850 targeted browser extensions, 728 focus on cryptocurrency wallets, encompassing “virtually every imaginable cryptocurrency wallet.”

“All the major names are present – MetaMask, Phantom, TrustWallet, Coinbase, Binance, Exodus, TronLink, Ronin, OKX, Keplr, Rabby, Sui, Solflare,” the researchers stated.

“However, the list extends far beyond the prominent names, reaching lesser-known projects with minimal user installations.”

Besides cryptocurrency wallets, the malware also aims at a substantial collection of over 100 password, token, and authenticator extensions, including LastPass, 1Password, Bitwarden, KeePass, NordPass, Dashlane, ProtonPass, Enpass, Psono, Pleasant Password Server, heylogin, 2FAAuth, GAuth, TOTP Authenticator, and Akamai MFA.

Torg Grabber also targets data from platforms such as Discord, Telegram, Steam, along with VPN and FTP applications, email programs, password managers, and desktop crypto wallet software.

Furthermore, the malware can gather information about the compromised system, generate a unique hardware profile, record installed software (including 24 antivirus programs), capture screenshots, and extract files from the Desktop and Documents folders.

Interestingly, it can also execute shellcode, delivered from its command center in an encrypted and compressed form.

Gen Digital warns that Torg Grabber is rapidly evolving, with new command-and-control domains appearing on a weekly cadence. Its user base is also growing, with 40 identified tags at the time of investigation.