CharlieKirk Grabber Malware Targets Windows Systems to Steal Login Credentials
The CharlieKirk Grabber is a Python-based infostealer targeting Windows systems for rapid data exfiltration. It is designed to steal credentials and other sensitive information without engaging in long-term system control or causing system damage.
The CharlieKirk Grabber is a Python-based infostealer targeting Windows systems for rapid data exfiltration. It is designed to steal credentials and other sensitive information without engaging in long-term system control or causing system damage.
File Name: CharlieKirk.exe File Size: 19.58 MB File Type: Executable Signed: Not Signed MD5 Hash: 598adf7491ff46f6b88d83841609b5cc SHA 256: f56afcdfd07386ecc127aa237c1a045332e4cc5822a9bcc77994d8882f074dd1 First Seen: Feb 2026
Upon execution, the malware initializes environment variables, sets up a working directory, and launches multiple data collection threads. It targets browser-stored passwords, Wi-Fi keys, Discord tokens, and gaming sessions, exfiltrating data through third-party file hosting and encrypted communication channels.
The malware profiles the host system using native commands and queries an external IP information service to gather data, which it writes to local temporary files. It forcibly terminates active browser processes to access locked databases, employing AES-GCM decryption for data recovery.
The CharlieKirk Grabber is a Python-based infostealer targeting Windows systems for rapid data exfiltration.
CharlieKirk Grabber targets both Chromium-based and Gecko-based browsers, leveraging various decryption methods to extract stored credentials. It also targets Wi-Fi profiles and Discord authentication tokens, validating them against Discord APIs to gather additional account information.
The malware attempts to establish persistence by copying its executable to a specified directory and creating a scheduled task. It compresses collected data into a ZIP archive for transfer, uploading it to file-hosting services and sending the link to attacker-controlled infrastructure via Discord webhooks or Telegram bots.
Defensive measures include monitoring for unusual process terminations and ZIP archive creation, scrutinizing HTTPS connections to certain platforms, and enforcing multi-factor authentication. Network monitoring should focus on traffic to Discord webhooks, Telegram APIs, and file-sharing services. Endpoint detection and response (EDR) solutions should be deployed to identify suspicious activities such as PowerShell executions modifying Defender settings.
Organizations are advised to limit browser password storage, block unsanctioned file-hosting platforms, and adopt Zero Trust principles to mitigate credential theft risks.
Based on reporting by GBHackers.