New 'Torg Grabber' Malware Targets 728 Crypto Wallets

Torg Grabber is a new infostealer malware that targets 728 crypto wallet extensions among 850 browser add-ons and is currently active. This malware is particularly dangerous for users of browser-based wallets, extracting sensitive information such as seed phrases and private keys through encrypted channels.

Key Takeaways

Torg Grabber targets 728 crypto wallet extensions across various browsers.
It uses a dropper disguised as a legitimate Chrome update to initiate infections.
The malware can steal credentials from browser extensions like MetaMask and Phantom.
Users of hardware wallets are indirectly at risk if sensitive information is stored digitally.
The ongoing threat from Torg Grabber could expand as its operators evolve their techniques.

Torg Grabber reveals the dangers of Crypto Malware, actively stealing crypto wallet data through encrypted channels.

Understanding the Torg Grabber Attack on Crypto Wallets

Torg Grabber is a newly identified malware that poses a significant threat to users of crypto wallet extensions. It exploits 728 different crypto wallets found among 850 different browser add-ons, demonstrating the extent of its potential impact. This malware is actively deployed and poses a risk especially to users of browser-based wallets.

According to researchers at Gen Digital, Torg Grabber works by stealing sensitive information such as seed phrases, private keys, and session tokens through encrypted channels. Alarmingly, it does this before most endpoint detection tools can catch it, leaving self-custody users with browser-based wallets vulnerable.

Research from Gen Digital revealed the threat after analyzing a loader chain through domain reputation data. They compiled 334 samples over a three-month window, indicating that this is not a simple proof-of-concept but rather a fully operational Malware-as-a-Service (MaaS) initiative with identifiable operators.

Scope of the Threat

Browser Extensions Affected: Torg Grabber scans 850 browser extensions, specifically targeting 728 crypto wallets across 25 Chromium and 8 Firefox variants.
Attack Methodology: The malware uses a dropper that pretends to be a legitimate Chrome update (GAPI_Update.exe) and exploits a fake Windows Security Update progress bar lasting 420 seconds. During this time, it deploys a payload that extracts personal data using advanced encryption.
At-Risk Users: Users of browser-based wallets such as MetaMask and Phantom are at the highest risk of credential theft. While hardware wallet users face indirect threats, especially if their seed phrases are stored digitally, they are not directly targeted.

How Torg Grabber Executes Its Attack

The attack chain begins with a dropper that masquerades as GAPI_Update.exe, a 60 MB InnoSetup package hosted on Dropbox. The dropper extracts three benign DLLs into the %LOCALAPPDATA%\Connector\ directory, creating an innocent-looking footprint. It then displays a fake Windows Security Update progress bar for exactly 420 seconds to provide cover for the malicious installation.

Once it executes, the final file appears with random names (such as v4jkqh.exe) in the C:\Windows\ directory. In one documented case, a 13 MB instance attempted to stop Windows Event Tracing but was thwarted by behavioral detection before it could execute its harmful actions.

After deployment, Torg Grabber targets a wide array of applications, including browsers, communication platforms, and password managers, alongside crypto wallets. The stolen data is either archived in memory or streamed in chunks, using sophisticated encryption and routing techniques to evade detection.

Gen Digital noted that more than 40 operator tags were found within the malware: these include nicknames, date-encoded batch IDs, and user IDs connecting operators to the Russian cybercrime ecosystem. This MaaS model allows individual operators to deploy custom malicious code after registration, effectively broadening the malware's attack surface.

What Does 728 Wallets Mean for Users?

The number 728 is significant; it reflects a targeted sweep across all major browser-based wallets with considerable installation volumes. For instance, MetaMask alone boasts over 30 million active users monthly. This means that Torg Grabber does not need to specifically identify a victim; it can harvest any wallet credentials present on an infected device.

Potential impact on crypto wallet users.

The implications for users are serious. Those who store their seed phrases in browser storage, text files, or password managers are at risk of complete wallet compromise from just one infection. While assets held in exchanges are not directly targeted, session tokens stored in browsers could expose connected exchange accounts if they remain logged in.

If Torg Grabber's operator base grows, as suggested by Gen Digital’s monitoring of its REST API infrastructure, the list of targeted wallets could expand beyond the initial 728. The situation is evolving, reminiscent of similar infostealers like Vidar and RedLine, which have shown the ability to adapt and grow over time.

Stay Vigilant

Regularly updating software and being cautious about wallet storage practices is crucial for protecting against such increasingly sophisticated malware threats.