{"id":10840,"date":"2026-02-21T10:03:47","date_gmt":"2026-02-21T10:03:47","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/02\/21\/charliekirk-grabber-stealer-attacking-windows-systems-to-exfiltrate-login-credentials\/"},"modified":"2026-02-21T10:03:47","modified_gmt":"2026-02-21T10:03:47","slug":"charliekirk-grabber-stealer-attacking-windows-systems-to-exfiltrate-login-credentials","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/02\/21\/charliekirk-grabber-stealer-attacking-windows-systems-to-exfiltrate-login-credentials\/","title":{"rendered":"CharlieKirk Grabber Stealer Attacking Windows Systems to Exfiltrate Login Credentials"},"content":{"rendered":"

CharlieKirk Grabber Stealer Attacking Windows Systems to Exfiltrate Login Credentials
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A new Python-based infostealer called CharlieKirk Grabber has been identified targeting Windows systems, with a focused goal of stealing stored login credentials, browser cookies, and session data. <\/p>\n

The malware is built to work as a \u201csmash-and-grab\u201d threat \u2014 it launches quickly, collects whatever sensitive data it can find, and disappears before the user notices anything unusual.<\/p>\n

The malware arrives as a Windows executable, packaged through a tool called PyInstaller, which bundles all its Python code into a single self-contained file that runs without requiring Python to be installed on the target machine. <\/p>\n

It borrows its name and political imagery from Turning Point USA to exploit social engineering. The malware is typically delivered through phishing emails, cracked software packages, game cheat downloads, or social media-based lures.<\/p>\n

Cyfirma researchers identified the malware<\/a> and noted that it uses a builder-style structure, which makes it modular. <\/p>\n

This means that whoever operates it can freely configure the command-and-control (C2) settings \u2014 such as a Discord webhook or a Telegram bot \u2014 and switch specific collection modules on or off before deploying the final executable.<\/p>\n

Once active on a system, CharlieKirk Grabber profiles the host by collecting the username, hostname, hardware UUID, and the external IP address<\/a>. <\/p>\n

It forcibly kills running browser processes using the Windows TASKKILL tool, unlocking access to saved password databases. <\/p>\n

The stolen data \u2014 covering passwords, cookies, autofill entries, browsing history, and Wi-Fi credentials \u2014 is then bundled into a ZIP archive and uploaded to the GoFile file-hosting platform. <\/p>\n

\n
\"CharlieKirk
CharlieKirk Grabber Stealer (Source \u2013 Cyfirma)<\/figcaption><\/figure>\n<\/div>\n

A download link is immediately sent to the attacker over HTTPS through either a Discord webhook<\/a> or a Telegram bot, keeping all communications encrypted.<\/p>\n

Living Off the Land: How CharlieKirk Stays Hidden<\/strong><\/h2>\n

What makes this stealer particularly difficult to detect is its heavy use of legitimate Windows tools that are already part of every installation. <\/p>\n

Instead of deploying suspicious third-party files, the malware uses NETSH.EXE to retrieve saved Wi-Fi passwords, SYSTEMINFO.EXE to map hardware and OS details, and PowerShell to silently add itself to Microsoft Defender\u2019s exclusion list. <\/p>\n

\n
\"UAC
UAC elevation attempt (Source \u2013 Cyfirma)<\/figcaption><\/figure>\n<\/div>\n

This method, known as \u201cliving off the land,\u201d lets malicious actions blend in with normal administrative behavior, helping it avoid signature-based detection.<\/p>\n

\n
\"Discord
Discord Token Theft and Account Validation (Source \u2013 Cyfirma)<\/figcaption><\/figure>\n<\/div>\n

Organizations should enforce Multi-Factor Authentication<\/a> across all critical services and restrict browser-based password storage through enterprise policy. <\/p>\n

Security teams should monitor for unusual browser process<\/a> termination events, outbound HTTPS traffic to Discord, Telegram, or GoFile, and any PowerShell activity in user-writable directories. <\/p>\n

\n
\"Credential
Credential and File Extraction Activity (Source \u2013 Cyfirma)<\/figcaption><\/figure>\n<\/div>\n

Execution from temporary paths such as\u00a0%TEMP%<\/code>\u00a0and\u00a0%APPDATA%<\/code>\u00a0should be blocked using AppLocker or Windows Defender Application Control (WDAC).<\/p>\n

Indicators of Compromise (IOC):-<\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n\n
Indicator Type<\/th>\nValue<\/th>\n<\/tr>\n<\/thead>\n
File Name<\/td>\nCharlieKirk.exe<\/td>\n<\/tr>\n
File Size<\/td>\n19.58 MB<\/td>\n<\/tr>\n
File Type<\/td>\nExecutable (PE32)<\/td>\n<\/tr>\n
MD5<\/td>\n598adf7491ff46f6b88d83841609b5cc<\/code><\/td>\n<\/tr>\n
SHA-256<\/td>\nf56afcdfd07386ecc127aa237c1a045332e4cc5822a9bcc77994d8882f074dd1<\/code><\/td>\n<\/tr>\n
First Seen in Wild<\/td>\nFebruary 2026<\/td>\n<\/tr>\n
C2 Channel<\/td>\nDiscord Webhook \/ Telegram Bot API<\/td>\n<\/tr>\n
Exfiltration Platform<\/td>\ngofile.io<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

MITRE ATT&CK Mapping:-<\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Tactic<\/th>\nTechnique ID<\/th>\nTechnique<\/th>\n<\/tr>\n<\/thead>\n
Discovery<\/td>\nT1082<\/td>\nSystem Information Discovery<\/td>\n<\/tr>\n
Discovery<\/td>\nT1033<\/td>\nSystem Owner\/User Discovery<\/td>\n<\/tr>\n
Credential Access<\/td>\nT1555.003<\/td>\nCredentials from Password Stores (Web Browsers)<\/td>\n<\/tr>\n
Credential Access<\/td>\nT1552.001<\/td>\nUnsecured Credentials: Credentials in Files<\/td>\n<\/tr>\n
Collection<\/td>\nT1560<\/td>\nArchive Collected Data<\/td>\n<\/tr>\n
Defense Evasion<\/td>\nT1202<\/td>\nIndirect Command Execution (LOLBins)<\/td>\n<\/tr>\n
Defense Evasion<\/td>\nT1562.001<\/td>\nImpair Defenses: Disable or Modify Security Tools<\/td>\n<\/tr>\n
Persistence<\/td>\nT1053.005<\/td>\nScheduled Task\/Job: Scheduled Task<\/td>\n<\/tr>\n
Privilege Escalation (Conditional)<\/td>\nT1548.002<\/td>\nAbuse Elevation Control Mechanism (UAC)<\/td>\n<\/tr>\n
Exfiltration<\/td>\nT1041<\/td>\nExfiltration Over C2 Channel<\/td>\n<\/tr>\n
Exfiltration<\/td>\nT1567.002<\/td>\nExfiltration to Cloud Storage<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n

The post CharlieKirk Grabber Stealer Attacking Windows Systems to Exfiltrate Login Credentials<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

CharlieKirk Grabber Stealer Attacking Windows Systems to Exfiltrate Login Credentials A new Python-based infostealer called CharlieKirk Grabber has been identified targeting Windows systems, with a focused goal of stealing stored login credentials, browser cookies, and session data. The malware is built to work as a \u201csmash-and-grab\u201d threat \u2014 it launches quickly, collects whatever sensitive data […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-10840","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10840"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=10840"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10840\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=10840"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=10840"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=10840"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}