Malware

TokenGrabber Builder

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

cyber security newsNews

Sep 28, 2026

Python MaaS Infostealer Builder Steals Passwords, Credit Cards and Cookies From 17 Browsers

A Python-based builder-and-payload credential-stealing operation that enables separate operators to generate customized Windows builds. Its payload targets 17 Chromium-based browsers plus Firefox; decrypts and steals saved logins, payment-card records, browsing history, and session cookies; collects Discord tokens, Roblox session cookies, saved Wi-Fi credentials, and victim system/location data; and sends an in-memory ZIP archive to configured webhook infrastructure. It uses debugger/VM and low-disk checks, delayed library loading, randomized sleep, XOR/Base64-obfuscated webhook configuration, and persistence through both a Run registry entry and a logon scheduled task.

malware newsNews

Sep 25, 2026

The Stealer Factory: Unpacking a Python-Based MaaS Infostealer Builder - Malware Analysis - Malware Analysis, News and Indicators

A Python-based MaaS infostealer builder that generates customized Windows payloads using Nuitka, PyInstaller, or raw Python scripts. Generated payloads use XOR/Base64-obfuscated webhook configuration, anti-analysis checks, Run-key and scheduled-task persistence, and steal browser credentials, cookies, payment-card data, Wi-Fi passwords, Discord tokens, Roblox session cookies, and host/geolocation data. Harvested information is compressed in memory and exfiltrated through an attacker-controlled webhook.

k7 labsNews

Sep 25, 2026

The Stealer Factory: Unpacking a Python-Based MaaS Infostealer Builder - K7 Labs

A MaaS-style Python malware builder that creates customized Windows infostealer binaries. The generated payload uses XOR/Base64 string obfuscation, anti-debugging and anti-VM checks, Registry Run-key and scheduled-task persistence, and exfiltrates collected data to a configured webhook. It steals Chromium and Firefox credentials, cookies, browsing history, payment-card data, Wi-Fi passwords, Discord tokens, Roblox session cookies, and host/geolocation data.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.