CharlieKirk Grabber Stealer Attacking Windows Systems to Exfiltrate Login Credentials

A new Python-based infostealer, named CharlieKirk Grabber, targets Windows systems with the intent of exfiltrating stored login credentials, browser cookies, and session data.

The malware operates as a rapid "smash-and-grab" threat. It initiates quickly, collects available sensitive data, and terminates before detection is possible by the user. Packaged as a Windows executable using PyInstaller, it functions independently of a Python installation on the target machine.

CharlieKirk Grabber employs social engineering tactics, borrowing names from Turning Point USA. It is typically distributed via phishing emails, cracked software, game cheats, or social media lures. Researchers from Cyfirma identified the malware's modular builder structure, allowing operators to configure command-and-control (C2) settings and enable specific modules before deployment.

Upon activation, the malware profiles the host by gathering the username, hostname, hardware UUID, and external IP address . It employs the Windows TASKKILL tool to terminate browser processes, enabling access to saved password databases. Stolen data, including passwords, cookies, autofill entries, browsing history, and Wi-Fi credentials, is archived in a ZIP file and uploaded to GoFile. A download link is sent to the attacker via HTTPS using a Discord webhook or Telegram bot, ensuring encrypted communication.

CharlieKirk Grabber leverages legitimate Windows tools to avoid detection. It uses NETSH.EXE for Wi-Fi credentials, SYSTEMINFO.EXE for hardware and OS details, and PowerShell to add itself to Microsoft Defender's exclusion list. This "living off the land" approach helps blend malicious activities with standard administrative tasks, bypassing signature-based detection methods.

Organizations should enforce Multi-Factor Authentication for critical services and restrict browser-based password storage through enterprise policies. Monitoring for unusual browser process terminations, outbound HTTPS traffic to Discord, Telegram, or GoFile, and PowerShell activities in user-writable directories is advised. Execution from paths like %TEMP% and %APPDATA% should be blocked using AppLocker or Windows Defender Application Control (WDAC).

Indicator Type Value

File Name CharlieKirk.exe

File Size 19.58 MB

File Type Executable (PE32)

MD5 598adf7491ff46f6b88d83841609b5cc

SHA-256 f56afcdfd07386ecc127aa237c1a045332e4cc5822a9bcc77994d8882f074dd1

First Seen in Wild February 2026

C2 Channel Discord Webhook / Telegram Bot API

Exfiltration Platform gofile.io

Tactic Technique ID Technique

Discovery T1082 System Information Discovery

Discovery T1033 System Owner/User Discovery

Credential Access T1555.003 Credentials from Password Stores (Web Browsers)

Credential Access T1552.001 Unsecured Credentials: Credentials in Files

Collection T1560 Archive Collected Data

Defense Evasion T1202 Indirect Command Execution (LOLBins)

Defense Evasion T1562.001 Impair Defenses: Disable or Modify Security Tools

Persistence T1053.005 Scheduled Task/Job: Scheduled Task

Privilege Escalation (Conditional) T1548.002 Abuse Elevation Control Mechanism (UAC)

Exfiltration T1041 Exfiltration Over C2 Channel

Exfiltration T1567.002 Exfiltration to Cloud Storage

Based on reporting by Cyber Security News.