New Infostealer Can Steal Passwords, Cards, Cookies and Wi-Fi Keys From Windows PCs
K7 Labs analyzed a Python infostealer builder that steals Windows browser secrets, cards, cookies, Discord tokens, and Wi-Fi passwords.
K7 Security Labs analyzed a Python infostealer builder, distributed as TokenGrabberBuilder.zip inside a nested archive, that generates customized Windows payloads. The embedded stealer.py harvests credentials, payment cards, history, and cookies from Chromium and Firefox, Discord tokens, Roblox session cookies, and plaintext Wi-Fi passwords via netsh. It obfuscates the webhook, checks for debuggers and virtual machines, and persists through a deceptive WindowsUpdate Run key plus an ONLOGON scheduled task. Stolen data is packed in memory as StolenData_<USERNAME>.zip and posted to an operator-controlled webhook.