TokenGrabber: Python-based MaaS Infostealer Builder

Key facts

Detection coverage

As of 2026-09-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2643 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Browser Credential / Cookie / Token Database Copy to Temp — TokenGrabber Harvesting (Post-Exploitation)

TokenGrabber's stealer.py targets Chromium (Login Data, Web Data, Network\Cookies, Local State), Discord LevelDB (Local Storage\leveldb), and Firefox (places.sqlite, cookies.sqlite) credential stores, copying locked databases to a temp location to bypass SQLite locking before DPAPI/AES decryption. This detection fires on browser credential/cookie/session-token database files appearing in temp directories — the collection and credential-access signal (T1555, T1539, T1528, T1005).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1555, T1539, T1528, T1005
• Data sources: sysmon, sentinel_file_events, windows_file_system
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| search TargetFilename="*\\Temp\\*" AND (TargetFilename="*\\AppData\\*" OR TargetFilename="*\\Users\\*")
| regex TargetFilename="(?i)\\(Login Data|Web Data|Cookies|Network\\Cookies|Local State|History|leveldb|places\\.sqlite|cookies\\.sqlite)$"
| table _time, host, User, Image, TargetFilename
| sort _time

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileCreated" or ActionType == "FileRenamed"
| where FolderPath matches regex @"(?i)\\Temp\\"
| where FolderPath matches regex @"(?i)(Login Data|Web Data|Network\\Cookies|Local State|History|leveldb|places\\.sqlite|cookies\\.sqlite)"
| where InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FolderPath, FileName
| order by Timestamp desc

Sigma

title: Browser Credential Database Copied to Temp - TokenGrabber
id: 6b1f2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects Chromium/Firefox credential, cookie and session-token database files (Login Data, Web Data, Network\Cookies, leveldb, cookies.sqlite, places.sqlite) being written or copied into a temporary directory, a hallmark of Python infostealers such as TokenGrabber that stage locked browser databases for decryption.
references:
  - https://labs.k7computing.com/index.php/the-stealer-factory-unpacking-a-python-based-maas-infostealer-builder/
author: Threadlinqs Team
date: 2026/09/25
tags:
  - attack.credential_access
  - attack.t1555
  - attack.t1539
  - attack.t1528
  - attack.t1005
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\\Temp\\'
    TargetFilename|endswith:
      - '\\Login Data'
      - '\\Web Data'
      - '\\Cookies'
      - '\\Local State'
      - '\\History'
      - '\\cookies.sqlite'
      - '\\places.sqlite'
      - '\\leveldb'
  filter_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  condition: selection and not filter_browser
falsepositives:
  - Browser upgrades or extensions that copy profile data for backup/import
  - Legitimate disk-migration tools staging profile folders
level: high

Known false positives:

• Browser upgrades or extensions copying profile data for backup
• Legitimate disk-migration tools staging profile folders

Tuning notes: Alert on any non-browser process (especially python.exe, pythonw.exe or a Packaged PyInstaller exe) creating browser database files in temp. Correlate with simultaneous access to multiple stores (Login Data + Cookies + leveldb) to reduce single-file false positives.

• 🔒 Python Interpreter Executing Obfuscated / Stealer Payload — TokenGrabber (Exploitation) · unlock with TL Creds
• 🔒 Deceptive '[indicator]' Run Key + ONLOGON Scheduled Task — TokenGrabber Persistence · unlock with TL Creds
• 🔒 Outbound POST to Webhook / Exfil Endpoints — TokenGrabber C2 Exfiltration · unlock with TL Creds
• 🔒 Sigma — Suspicious Python & pip Execution ([indicator]) · unlock with TL Creds
• 🔒 Sigma — Wi-Fi Credential Dump via netsh wlan key=clear (TokenGrabber) · unlock with TL Creds
• 🔒 Sigma — Browser Credential / Session-Token Database Access (TokenGrabber) · unlock with TL Creds
• 🔒 Unexpected Python / pip Runtime Dependency Install — [indicator] (Exploitation) · unlock with TL Creds
• 🔒 Exfiltration POST to Discord / Telegram Webhook or Pastebin API — TokenGrabber (C2 / Exfiltration) · unlock with TL Creds

Indicators of compromise

As of 2026-09-25, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-2643.

Sample indicators (3 of 26)

• URL: hxxps://pastebin[.]com/api/api_post.php
• File hash: 1ab7846f93678fb727c95df133c1b0a050760b11dd164ca5f6408e84398b676e
• File hash: 7053dc55b4ba193ea162f01a329427fd244d8163a65cbf2a7f86c04c849c8114

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

Technical analysis

No CVE or operator attribution is disclosed.

TokenGrabber is a Python-coded Malware-as-a-Service infostealer builder family analyzed by K7 Labs (analyst Deepa B). The distribution chain observed in the wild begins as a RAR archive named "my new program called 2.rar" (SHA-256 1ab7846f93678fb727c95df133c1b0a050760b11dd164ca5f6408e84398b676e) that unpacks to a nested TokenGrabberBuilder.zip (SHA-256 7053dc55b4ba193ea162f01a329427fd244d8163a65cbf2a7f86c04c849c8114) containing a "TokenGrabber Builder" folder. The builder compiles customized Windows executables for different operators, a hallmark of the MaaS model that provides affiliate scalability, reduced attribution (a unique per-binary webhook encoding yields a different hash per build), and a low barrier to entry via an interactive UI.

At startup the builder auto-installs required Python libraries via pip, so an unexpected runtime invocation of pip.exe is a documented detection signal. It locates a Python interpreter via _find_python() by probing PATH, %LOCALAPPDATA%\Programs\Python\, %USERPROFILE%\Python\, C:\, C:\Program Files and C:\Program Files (x86), version folders for Python 3.14-3.8, and the HKCU and HKLM SOFTWARE\Python\PythonCore registry keys. The operator-supplied webhook URL is stored in a webhook.txt file in the working directory and reused across build sessions. It is encoded with XOR using key 0x5A and then Base64, and injected as a string literal into the payload template; a runtime _x() function reverses the encoding. This means no plaintext webhook appears in binaries, producing a unique hash per webhook and weakening 1:1 URL-based signatures.

Three compilation backends are offered. Nuitka compiles Python to C then native code, leaving no recoverable Python bytecode or .pyc, defeating decompilers such as uncompyle6/decompile3 (the UI labels it "Nuitka - slower, stronger AV evasion"). PyInstaller packages the interpreter and bytecode, which is unpackable with pyinstxtractor to recover .pyc; the builder writes a custom .spec via _write_spec() excluding tkinter, matplotlib, numpy and pandas to shrink size and reduce the detection surface. A raw-script backend saves stealer.py uncompiled for manual deployment.

The embedded payload (stealer.py, SHA-256 9e471343255259f7fb388f1f07b0e023261630dbdc01f5d647dc99f452119eff) hardens against analysis and sandboxes. All sensitive strings are stored as Base64 + XOR-0x5A blobs decoded into an _E dictionary, including the webhook exfil URL (_H), the registry Run path Software\Microsoft\Windows\CurrentVersion\Run (_E["rk"]), a secondary exfiltration endpoint https://pastebin.com/api/api_post.php (_E["pburl"]), the scheduled-task command schtasks /create /tn (_E["st"]), and the Wi-Fi enumeration command netsh wlan show profiles (_E["nw"]). High-risk imports are loaded lazily via getter functions only when needed. The _debug_check() routine calls IsDebuggerPresent() via ctypes (catching x64dbg, WinDbg, PyCharm debuggers), maintains a process blacklist via psutil for VirtualBox, Xen, QEMU and Parallels artifacts, exits if total disk is below 50 GB, and uses a PID-derived variable sleep to outlast sandbox time limits.

Persistence is dual. The payload registers HKCU\Software\Microsoft\Windows\CurrentVersion\Run under the deceptive name WindowsUpdate, and creates a scheduled task with an ONLOGON trigger launched with creationflags=0x08000000 (CREATE_NO_WINDOW) and stdout/stderr redirected to DEVNULL.

Credential harvesting spans 17 Chromium-based browsers (targeting User Data directories under %LOCALAPPDATA% and %APPDATA%), Firefox profiles under %APPDATA%\Mozilla\Firefox\Profiles, Wi-Fi credentials, Discord tokens and Roblox sessions. For Chromium, the payload extracts the AES master key from Local State via os_crypt.encrypted_key using DPAPI (CryptUnprotectData), copies locked databases to temp to bypass SQLite locking, and decrypts with AES-256-GCM (or a DPAPI fallback). _f0() targets Login Data (URLs, usernames, passwords), _f1() History (browsing history with timestamps), _f2() Web Data (credit card numbers, names, expiry dates), and _f3() Cookies/Network\Cookies (session cookies). Firefox data (places.sqlite history and cookies.sqlite) is read in plaintext with no decryption. Wi-Fi passwords are pulled via netsh wlan show profiles with key=clear. Discord tokens are extracted from LevelDB (Local Storage\leveldb), decrypted with an AES-GCM key plus regex for older token formats, and validated against the live API /api/v9/users/@me before exfiltration. Roblox .ROBLOSECURITY cookies are harvested from Chromium and Firefox and checked against Roblox before packaging. Geo/system recon captures public IP, country, city, ISP, GPS coordinates, timezone, %USERNAME% and %COMPUTERNAME%.

Exfiltration assembles all data in-memory into a ZIP via BytesIO (no disk writes) named StolenData_<USERNAME>.zip and sends it via HTTP POST to the webhook endpoint, with pastebin as a secondary exfil channel. Because no CVE applies and no operator is attributed, the family is treated as an active MaaS credential-theft and session-token threat. The pattern closely parallels other open-source Python MaaS infostealer builders (e.g. BlankGrabber, Arkanix Stealer) that ship a stealer.py payload, auto-install pip dependencies, and exfiltrate via Discord/Telegram webhooks, confirming TokenGrabber sits within a broader low-barrier-to-entry credential-theft ecosystem.

Detection opportunities documented by K7 Labs include unexpected pip.exe execution, suspicious Registry Run keys and scheduled tasks, netsh wlan show profiles invocation, browser credential/cookie database access, HTTP POSTs to unknown webhook endpoints, and ZIP archives containing collected system data.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1560 Archive Collected Data

Discovery

T1012 Query Registry; T1057 Process Discovery; T1082 System Information Discovery

Defense Evasion

T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion

Persistence

T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution

Execution

T1059 Command and Scripting Interpreter

defense-impairment

T1112 Modify Registry

execution

T1204 User Execution

Credential Access

T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Exfiltration

T1567 Exfiltration Over Web Service

Remediation

Immediate actions

• Block inbound/outbound traffic to unknown Discord/Telegram webhook endpoints and pastebin API exfil URLs at perimeter egress
• Alert on unexpected pip.exe invocation on endpoint hosts
• Hunt for the documented file hashes and deceptive 'WindowsUpdate' Run key / scheduled task names
• Alert on netsh wlan show profiles with key=clear and browser credential/cookie database file reads

Workarounds

• Disable or restrict PowerShell/script hosts and native netsh wlan profile disclosure where not required
• Use browser password managers with OS-level protection rather than browser-native autofill stores

Longer-term hardening

• Deploy EDR with behavioral detection for browser credential/cookie database reads, netsh wlan profile dumps, and in-memory ZIP webhook POSTs
• Enforce application allowlisting to block unknown Python/PyInstaller/Nuitka binaries
• Restrict Discord/Roblox session tokens at the host via token-lifetime and session controls
• Correlate outbound webhook POSTs with in-memory archive creation (BytesIO/zipfile) as an exfiltration signal

Timeline

• 2026-09-25 Placed within the broader open-source Python MaaS infostealer trend (BlankGrabber, Arkanix Stealer) that shares locked-ioc-17 + pip-loader + webhook-exfil architecture; no CVE and no operator attribution disclosed.
• 2026-09-25 Exfiltration documented as an in-memory ZIP (BytesIO) named StolenData_<USERNAME>.zip POSTed to the attacker webhook, with pastebin.com/api/api_post.php as a secondary channel; geo/system recon captured.
• 2026-09-25 Credential harvesting documented across 17 Chromium browsers (DPAPI + AES-256-GCM decryption of Login Data/History/Web Data/Cookies), Firefox profiles, Wi-Fi passwords (netsh key=clear), Discord LevelDB tokens and Roblox .ROBLOSECURITY cookies.
• 2026-09-25 Dual persistence documented: deceptive 'WindowsUpdate' HKCU Run key and an ONLOGON scheduled task launched with CREATE_NO_WINDOW (0x08000000) and output redirected to DEVNULL.
• 2026-09-25 Anti-analysis/sandbox evasion documented: IsDebuggerPresent() via ctypes (x64dbg/WinDbg/PyCharm), psutil process blacklist (VirtualBox/Xen/QEMU/Parallels), <50 GB disk check, PID-derived variable sleep.
• 2026-09-25 XOR-0x5A + Base64 webhook injection into the embedded locked-ioc-17 payload (SHA-256 9e471343...eff) documented, with runtime _x() deobfuscation and locked-ioc-16 persistence of the operator URL.
• 2026-09-25 Nested locked-ioc-13 (SHA-256 7053dc55...114) unpacked; Nuitka, PyInstaller and raw-script compilation backends identified, plus _find_python() interpreter discovery and automatic pip dependency installation.
• 2026-09-25 Initial distribution sample observed in the wild as the RAR archive 'my new program called 2.rar' (SHA-256 1ab7846f...676e).
• 2026-09-25 K7 Labs publicly documents the TokenGrabber Python MaaS infostealer builder family (analysis by Deepa B).

Sources cited

• Arkanix Stealer: a C/Python MaaS infostealer (Kaspersky research summary; pip loader, stealer.py, webhook/panel exfil) hendryadrian.com · Research
• Arkanix Stealer (SecureList, Kaspersky) - underlying MaaS infostealer report cited by the above Kaspersky Securelist · Research
• Surge in Open-Source Malware (GBHackers) - BlankGrabber Python infostealer builder trend gbhackers.com · Research
• bewafa/grabber - educational Discord token grabber with WindowsUpdate.exe PyInstaller build, Run-key persistence, webhook exfil (corroborates pattern) GitHub · Code repository
• americx3213/Krypto-Stealer - Python credential stealer, webhook exfil, GUI builder GitHub · Code repository
• JesterHAXX/Byte-Stealer - Discord token grabber via webhook, anti-analysis GitHub · Code repository
• BengaminButton/XillenStealer - stealer.py multi-browser Chromium cookie/password extractor GitHub · Code repository
• The Stealer Factory: Unpacking a Python-based MaaS Infostealer Builder (K7 Labs, Deepa B) labs.k7computing.com · Blog · 2026-09-25

More in malware

• PureRAT and PureLogs Campaign Targeting Japanese Organizations (Phishing, Donut Loader, BYOVD via Lenovo-signed BootRepair.sys)
• SnakeKeylogger infostealer delivered via quote-request phishing emails (JavaScript/PowerShell chain, process hollowing into aspnet_compiler.exe)
• SCKit Campaign: Rogue ScreenConnect Clients Deployed Across 288 Devices at 48 Organizations via Hijacked ScreenConnect Panels and RMM+ Extension
• Threat actors weaponizing GSocket (gs-netcat) for stealthy C2 and persistence on compromised Linux web servers (CVE-2026-43284 LPE attempts)
• eBPF Rootkits Gaining Traction on Underground Forums (Flare research; BPFDoor, Symbiote, LinkPro, CVE-2017-16995 reposts)

Previous and next in malware

• MacSync macOS infostealer abuses public iCloud calendars as a command channel to deliver a new backdoor module Previous report
• Multi-Stage Abuse of Legitimate Remote Access Tools (ConnectWise, N-Able, SimpleHelp, Datto RMM, GoTo) by Initial Access Brokers Next report