TokenGrabber is a Python-coded Malware-as-a-Service infostealer builder family analyzed by K7 Labs (analyst Deepa B). The distribution chain observed in the wild begins as a RAR archive named "my new program called 2.rar" (SHA-256 1ab7846f93678fb727c95df133c1b0a050760b11dd164ca5f6408e84398b676e) that unpacks to a nested TokenGrabberBuilder.zip (SHA-256 7053dc55b4ba193ea162f01a329427fd244d8163a65cbf2a7f86c04c849c8114) containing a "TokenGrabber Builder" folder. The builder compiles customized Windows executables for different operators, a hallmark of the MaaS model that provides affiliate scalability, reduced attribution (a unique per-binary webhook encoding yields a different hash per build), and a low barrier to entry via an interactive UI.

At startup the builder auto-installs required Python libraries via pip, so an unexpected runtime invocation of pip.exe is a documented detection signal. It locates a Python interpreter via _find_python() by probing PATH, %LOCALAPPDATA%\Programs\Python\, %USERPROFILE%\Python\, C:\, C:\Program Files and C:\Program Files (x86), version folders for Python 3.14-3.8, and the HKCU and HKLM SOFTWARE\Python\PythonCore registry keys. The operator-supplied webhook URL is stored in a webhook.txt file in the working directory and reused across build sessions. It is encoded with XOR using key 0x5A and then Base64, and injected as a string literal into the payload template; a runtime _x() function reverses the encoding. This means no plaintext webhook appears in binaries, producing a unique hash per webhook and weakening 1:1 URL-based signatures.

Three compilation backends are offered. Nuitka compiles Python to C then native code, leaving no recoverable Python bytecode or .pyc, defeating decompilers such as uncompyle6/decompile3 (the UI labels it "Nuitka - slower, stronger AV evasion"). PyInstaller packages the interpreter and bytecode, which is unpackable with pyinstxtractor to recover .pyc; the builder writes a custom .spec via _write_spec() excluding tkinter, matplotlib, numpy and pandas to shrink size and reduce the detection surface. A raw-script backend saves stealer.py uncompiled for manual deployment.

The embedded payload (stealer.py, SHA-256 9e471343255259f7fb388f1f07b0e023261630dbdc01f5d647dc99f452119eff) hardens against analysis and sandboxes. All sensitive strings are stored as Base64 + XOR-0x5A blobs decoded into an _E dictionary, including the webhook exfil URL (_H), the registry Run path Software\Microsoft\Windows\CurrentVersion\Run (_E["rk"]), a secondary exfiltration endpoint https://pastebin.com/api/api_post.php (_E["pburl"]), the scheduled-task command schtasks /create /tn (_E["st"]), and the Wi-Fi enumeration command netsh wlan show profiles (_E["nw"]). High-risk imports are loaded lazily via getter functions only when needed. The _debug_check() routine calls IsDebuggerPresent() via ctypes (catching x64dbg, WinDbg, PyCharm debuggers), maintains a process blacklist via psutil for VirtualBox, Xen, QEMU and Parallels artifacts, exits if total disk is below 50 GB, and uses a PID-derived variable sleep to outlast sandbox time limits.

Persistence is dual. The payload registers HKCU\Software\Microsoft\Windows\CurrentVersion\Run under the deceptive name WindowsUpdate, and creates a scheduled task with an ONLOGON trigger launched with creationflags=0x08000000 (CREATE_NO_WINDOW) and stdout/stderr redirected to DEVNULL.

Credential harvesting spans 17 Chromium-based browsers (targeting User Data directories under %LOCALAPPDATA% and %APPDATA%), Firefox profiles under %APPDATA%\Mozilla\Firefox\Profiles, Wi-Fi credentials, Discord tokens and Roblox sessions. For Chromium, the payload extracts the AES master key from Local State via os_crypt.encrypted_key using DPAPI (CryptUnprotectData), copies locked databases to temp to bypass SQLite locking, and decrypts with AES-256-GCM (or a DPAPI fallback). _f0() targets Login Data (URLs, usernames, passwords), _f1() History (browsing history with timestamps), _f2() Web Data (credit card numbers, names, expiry dates), and _f3() Cookies/Network\Cookies (session cookies). Firefox data (places.sqlite history and cookies.sqlite) is read in plaintext with no decryption. Wi-Fi passwords are pulled via netsh wlan show profiles with key=clear. Discord tokens are extracted from LevelDB (Local Storage\leveldb), decrypted with an AES-GCM key plus regex for older token formats, and validated against the live API /api/v9/users/@me before exfiltration. Roblox .ROBLOSECURITY cookies are harvested from Chromium and Firefox and checked against Roblox before packaging. Geo/system recon captures public IP, country, city, ISP, GPS coordinates, timezone, %USERNAME% and %COMPUTERNAME%.

Exfiltration assembles all data in-memory into a ZIP via BytesIO (no disk writes) named StolenData_<USERNAME>.zip and sends it via HTTP POST to the webhook endpoint, with pastebin as a secondary exfil channel. Because no CVE applies and no operator is attributed, the family is treated as an active MaaS credential-theft and session-token threat. The pattern closely parallels other open-source Python MaaS infostealer builders (e.g. BlankGrabber, Arkanix Stealer) that ship a stealer.py payload, auto-install pip dependencies, and exfiltrate via Discord/Telegram webhooks, confirming TokenGrabber sits within a broader low-barrier-to-entry credential-theft ecosystem.

Detection opportunities documented by K7 Labs include unexpected pip.exe execution, suspicious Registry Run keys and scheduled tasks, netsh wlan show profiles invocation, browser credential/cookie database access, HTTP POSTs to unknown webhook endpoints, and ZIP archives containing collected system data.