article Massive Crypto Breach: Torg Grabber Targeting 728 Different Wallets

A sophisticated new threat has hit the digital asset space. Known as Torg Grabber, this aggressive infostealer is currently on the hunt, specifically optimized to compromise 728 different crypto wallet extensions hidden within 850 browser add-ons. This isn't just a theory or a test; the malware is fully operational and actively draining accounts as we speak.

The software is designed to snatch seed phrases, private keys, and session tokens. It moves this data through encrypted tunnels so quickly that most standard antivirus or endpoint security tools fail to flag it until the damage is already done. If you use a browser-based wallet for self-custody, you are directly in the crosshairs.

Security analysts recently uncovered this campaign after monitoring a complex loading chain. Their investigation revealed over 300 unique samples developed over a three-month period. This is a professional Malware-as-a-Service (MaaS) operation, run by organized groups rather than solo hackers.

The Stats: What’s Under Attack?

• Breadth of Attack: The malware scans 850 extensions, focusing on 728 specific crypto targets.

• Browser Support: It is compatible with 25 Chromium-based browsers and 8 versions of Firefox.

• The Decoy: It arrives as a fake Chrome update named GAPI_Update.exe (approx. 60 MB).

• The Deception: It displays a fake "Windows Security Update" bar that lasts for exactly 420 seconds to distract the user while the infection takes hold.

• Technical Sophistication: Stolen data is protected using ChaCha20 encryption and HMAC-SHA256 authentication, routed through Cloudflare to blend in with legitimate web traffic.

Inside the Attack: How Torg Grabber Operates

The infection begins when a user downloads a "dropper" disguised as a system update. This 60 MB package (built with InnoSetup) is typically hosted on platforms like Dropbox. Once launched, it places three harmless-looking DLL files into the following directory to avoid suspicion:

%LOCALAPPDATA%\Connector\

While the user watches an animated ASCII progress bar—thinking their system is updating—the real payload is deployed in the background. The malware then generates a randomized executable name to hide within the Windows directory:

In observed cases, the malware has attempted to shut down Event Tracing for Windows (ETW) to blind security monitoring software. Once active, it doesn't just stop at crypto. Torg Grabber goes after:

• Discord, Telegram, and Steam credentials.

• VPN and FTP client data.

• Email accounts and password managers.

The stolen information is either compressed into a ZIP file in the system's memory or sent out in small "chunks" to avoid triggering network alarms. By using Cloudflare endpoints and high-level encryption headers, the hackers have built a "production-grade" pipeline for stolen data

The Business of Cybercrime

The architecture of this malware suggests a highly organized Russian-linked ecosystem. The binaries contain various "operator tags" and IDs, allowing different criminals to "rent" the software and deploy their own custom malicious code once they have infected a victim.

Experts have described the setup as a "poisoned Swiss watch"—it is incredibly precise, reliable, and deadly for anyone holding digital assets.

Who is Most at Risk?

The number 728 is significant because it covers nearly every browser wallet with a substantial user base. If you use MetaMask, Phantom, or similar "hot wallets" as browser extensions, you are the primary target.

• Software Wallet Users: If your seed phrase is stored in your browser, a text file, or a basic password manager, one infection means your funds are gone.

• Exchange Users: While the malware doesn't "hack" the exchange itself, it can steal session tokens. If you are logged into an exchange in your browser, the hackers could potentially hijack that active session to bypass login requirements.

• Hardware Wallet Users: You are generally safe, unless you have typed your recovery seed into your computer or stored a digital copy of it.

The threat list is expected to grow. Torg Grabber follows the path blazed by older malware like Vidar or RedLine, but with a much more polished and industrial-strength infrastructure. In the world of crypto, your security is only as strong as your most recent habit—stay alert and keep your sensitive data offline.