# TokenGrabber: Python-based MaaS Infostealer Builder

> K7 Labs documents "TokenGrabber", a Python-based Malware-as-a-Service (MaaS) infostealer builder family. A builder (Nuitka, PyInstaller, or raw-script backends) auto-installs pip dependencies and injects an XOR-0x5A-then-Base64-encoded webhook into an embedded stealer.py payload. The Windows payload steals Chromium (17 browsers) and Firefox credentials/cookies, credit cards, Wi-Fi passwords, Discord tokens, and Roblox session cookies, performs geo/system recon, persists via a deceptive Registry Run key and scheduled task, and exfiltrates as an in-memory ZIP to an attacker-controlled webhook. No CVE or operator attribution is disclosed.

- **Published:** 2026-09-25T00:00:00Z
- **Last reviewed:** 2026-09-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2643
- **ID:** TL-2026-2643
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

TokenGrabber is a Python-coded Malware-as-a-Service infostealer builder family analyzed by K7 Labs (analyst Deepa B). The distribution chain observed in the wild begins as a RAR archive named "my new program called 2.rar" (SHA-256 1ab7846f93678fb727c95df133c1b0a050760b11dd164ca5f6408e84398b676e) that unpacks to a nested TokenGrabberBuilder.zip (SHA-256 7053dc55b4ba193ea162f01a329427fd244d8163a65cbf2a7f86c04c849c8114) containing a "TokenGrabber Builder" folder. The builder compiles customized Windows executables for different operators, a hallmark of the MaaS model that provides affiliate scalability, reduced attribution (a unique per-binary webhook encoding yields a different hash per build), and a low barrier to entry via an interactive UI.

At startup the builder auto-installs required Python libraries via pip, so an unexpected runtime invocation of pip.exe is a documented detection signal. It locates a Python interpreter via _find_python() by probing PATH, %LOCALAPPDATA%\Programs\Python\, %USERPROFILE%\Python\, C:\, C:\Program Files and C:\Program Files (x86), version folders for Python 3.14-3.8, and the HKCU and HKLM SOFTWARE\Python\PythonCore registry keys. The operator-supplied webhook URL is stored in a webhook.txt file in the working directory and reused across build sessions. It is encoded with XOR using key 0x5A and then Base64, and injected as a string literal into the payload template; a runtime _x() function reverses the encoding. This means no plaintext webhook appears in binaries, producing a unique hash per webhook and weakening 1:1 URL-based signatures.

Three compilation backends are offered. Nuitka compiles Python to C then native code, leaving no recoverable Python bytecode or .pyc, defeating decompilers such as uncompyle6/decompile3 (the UI labels it "Nuitka - slower, stronger AV evasion"). PyInstaller packages the interpreter and bytecode, which is unpackable with pyinstxtractor to recover .pyc; the builder writes a custom .spec via _write_spec() excluding tkinter, matplotlib, numpy and pandas to shrink size and reduce the detection surface. A raw-script backend saves stealer.py uncompiled for manual deployment.

The embedded payload (stealer.py, SHA-256 9e471343255259f7fb388f1f07b0e023261630dbdc01f5d647dc99f452119eff) hardens against analysis and sandboxes. All sensitive strings are stored as Base64 + XOR-0x5A blobs decoded into an _E dictionary, including the webhook exfil URL (_H), the registry Run path Software\Microsoft\Windows\CurrentVersion\Run (_E["rk"]), a secondary exfiltration endpoint https://pastebin.com/api/api_post.php (_E["pburl"]), the scheduled-task command schtasks /create /tn (_E["st"]), and the Wi-Fi enumeration command netsh wlan show profiles (_E["nw"]). High-risk imports are loaded lazily via getter functions only when needed. The _debug_check() routine calls IsDebuggerPresent() via ctypes (catching x64dbg, WinDbg, PyCharm debuggers), maintains a process blacklist via psutil for VirtualBox, Xen, QEMU and Parallels artifacts, exits if total disk is below 50 GB, and uses a PID-derived variable sleep to outlast sandbox time limits.

Persistence is dual. The payload registers HKCU\Software\Microsoft\Windows\CurrentVersion\Run under the deceptive name WindowsUpdate, and creates a scheduled task with an ONLOGON trigger launched with creationflags=0x08000000 (CREATE_NO_WINDOW) and stdout/stderr redirected to DEVNULL.

Credential harvesting spans 17 Chromium-based browsers (targeting User Data directories under %LOCALAPPDATA% and %APPDATA%), Firefox profiles under %APPDATA%\Mozilla\Firefox\Profiles, Wi-Fi credentials, Discord tokens and Roblox sessions. For Chromium, the payload extracts the AES master key from Local State via os_crypt.encrypted_key using DPAPI (CryptUnprotectData), copies locked databases to temp to bypass SQLite locking, and decrypts with AES-256-GCM (or a DPAPI fallback). _f0() targets Login Data (URLs, usernames, passwords), _f1() History (browsing history with timestamps), _f2() Web Data (credit card numbers, names, expiry dates), and _f3() Cookies/Network\Cookies (session cookies). Firefox data (places.sqlite history and cookies.sqlite) is read in plaintext with no decryption. Wi-Fi passwords are pulled via netsh wlan show profiles with key=clear. Discord tokens are extracted from LevelDB (Local Storage\leveldb), decrypted with an AES-GCM key plus regex for older token formats, and validated against the live API /api/v9/users/@me before exfiltration. Roblox .ROBLOSECURITY cookies are harvested from Chromium and Firefox and checked against Roblox before packaging. Geo/system recon captures public IP, country, city, ISP, GPS coordinates, timezone, %USERNAME% and %COMPUTERNAME%.

Exfiltration assembles all data in-memory into a ZIP via BytesIO (no disk writes) named StolenData_<USERNAME>.zip and sends it via HTTP POST to the webhook endpoint, with pastebin as a secondary exfil channel. Because no CVE applies and no operator is attributed, the family is treated as an active MaaS credential-theft and session-token threat. The pattern closely parallels other open-source Python MaaS infostealer builders (e.g. BlankGrabber, Arkanix Stealer) that ship a stealer.py payload, auto-install pip dependencies, and exfiltrate via Discord/Telegram webhooks, confirming TokenGrabber sits within a broader low-barrier-to-entry credential-theft ecosystem.

Detection opportunities documented by K7 Labs include unexpected pip.exe execution, suspicious Registry Run keys and scheduled tasks, netsh wlan show profiles invocation, browser credential/cookie database access, HTTP POSTs to unknown webhook endpoints, and ZIP archives containing collected system data.

## MITRE ATT&CK

- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1112 Modify Registry
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1082 System Information Discovery
- T1012 Query Registry
- T1057 Process Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1567 Exfiltration Over Web Service

## Sources

- [The Stealer Factory: Unpacking a Python-based MaaS Infostealer Builder (K7 Labs, Deepa B)](https://labs.k7computing.com/index.php/the-stealer-factory-unpacking-a-python-based-maas-infostealer-builder/)
- [bewafa/grabber - educational Discord token grabber with WindowsUpdate.exe PyInstaller build, Run-key persistence, webhook exfil (corroborates pattern)](https://github.com/bewafa/grabber)
- [Arkanix Stealer: a C/Python MaaS infostealer (Kaspersky research summary; pip loader, stealer.py, webhook/panel exfil)](https://www.hendryadrian.com/arkanix-stealer-a-c-python-infostealer/)
- [Arkanix Stealer (SecureList, Kaspersky) - underlying MaaS infostealer report cited by the above](https://securelist.com/arkanix-stealer/119006/)
- [americx3213/Krypto-Stealer - Python credential stealer, webhook exfil, GUI builder](https://github.com/americx3213/Krypto-Stealer)
- [JesterHAXX/Byte-Stealer - Discord token grabber via webhook, anti-analysis](https://github.com/JesterHAXX/Byte-Stealer)
- [BengaminButton/XillenStealer - stealer.py multi-browser Chromium cookie/password extractor](https://github.com/BengaminButton/XillenStealer/blob/main/stealer.py)
- [Surge in Open-Source Malware (GBHackers) - BlankGrabber Python infostealer builder trend](https://gbhackers.com/surge-open-source-malware/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2643