Connect with us
DAPA Banner

Crypto World

New ‘Torg Grabber’ Malware Targets 728 Crypto Wallets

Published

on

🚨

Torg Grabber, a newly identified infostealer malware, targets 728 crypto wallet extensions across 850 browser add-ons, and it is already in active deployment.

The malware exfiltrates seed phrases, private keys, and session tokens through encrypted channels before most endpoint tools register a detection event. Self-custody users running browser-based wallets are the primary exposure surface.

Gen Digital researchers documented the threat after tracing a loader chain through domain reputation data, ultimately compiling 334 samples across a three-month development window. This is not a proof-of-concept. It is a live Malware-as-a-Service operation with identified operators.

Key Takeaways:
Advertisement
  • Threat Scope: Torg Grabber scans 850 browser extensions, 728 of them crypto wallet targets, across 25 Chromium and 8 Firefox browser variants.
  • Attack Method: Dropper masquerades as a legitimate Chrome update (GAPI_Update.exe, 60 MB), deploys payload via a fake 420-second Windows Security Update progress bar, then exfiltrates data using ChaCha20 encryption with HMAC-SHA256 authentication through Cloudflare infrastructure.
  • Who Is at Risk: Browser-extension wallet users — MetaMask, Phantom, and comparable hot wallets — face direct credential theft; hardware wallet users face indirect risk only if seed phrases are stored digitally.

Discover: The best crypto presales gaining institutional momentum right now

The Mechanism: How Torg Grabber Malware Executes the Attack On Crypto Wallets

The infection chain opens with a dropper disguised as GAPI_Update.exe — a 60 MB InnoSetup package distributed from Dropbox infrastructure. It extracts three benign DLLs into %LOCALAPPDATA%\Connector\ to establish a clean-looking footprint, then launches a fake Windows Security Update progress bar running for exactly 420 seconds, complete with animated ASCII art compiled via csc.exe. The delay is deliberate: it creates a plausible installation window while the payload deploys.

The final executable drops under randomized names — v4jkqh.exe, hkjpy08.exe, ln3dkgz.exe — into C:\Windows\ across documented samples. One captured 13 MB instance spawned dllhost.exe and attempted to disable Event Tracing for Windows before behavioral detection terminated it mid-execution.

Post-deployment, Torg Grabber targets 25 Chromium browsers, 8 Firefox variants, Discord, Steam, Telegram, VPN clients, FTP clients, email clients, and password managers in addition to crypto wallets. Data is archived to an in-memory ZIP or streamed in chunks. Exfiltration routes through Cloudflare endpoints using per-request HMAC-SHA256 X-Auth-Token headers and ChaCha20 encryption — a production-grade architecture, not improvised tooling.

Advertisement

Gen Digital’s analysis identified over 40 operator tags embedded in binaries: nicknames, date-encoded batch IDs, and Telegram user IDs linking eight operators to the Russian cybercrime ecosystem. The MaaS model means individual operators can deploy custom shellcode post-registration, expanding the attack surface beyond the base configuration. As Gen Digital researchers described it, Torg Grabber evolved from Telegram dead drops to “a production-grade REST API that worked like a Swiss watch dipped in poison.”

Discover: The best crypto to diversify your portfolio with

The Self-Custody Signal: What 728 Wallets Actually Means

Advertisement

728 is not an arbitrary number. It represents a deliberate configuration sweep, every major browser-based wallet with measurable installation volume. MetaMask alone has over 30 million monthly active users. The extension-targeting logic means Torg Grabber does not need to find a specific victim; it harvests whatever wallet credentials are present on any infected machine.

The broader risk bifurcates cleanly. Self-custody users storing seed phrases in browser storage, text files, or password managers face complete wallet compromise on a single infection. Exchange-held assets are not directly exposed to this specific attack vector, the malware targets local credential stores, not exchange APIs at scale. But session token theft from browser storage can expose connected exchange accounts if login sessions are active.

If Torg Grabber’s MaaS operator base expands, and Gen Digital’s monitoring of its REST API infrastructure suggests active iteration, the wallet targeting list will grow. The 728 figure is a current snapshot, not a ceiling. Comparable infostealers like Vidar and RedLine normalized this model years ago; Torg Grabber is executing the same playbook with more structured infrastructure.

Discover: The best crypto presales gaining institutional momentum right now

The post New ‘Torg Grabber’ Malware Targets 728 Crypto Wallets appeared first on Cryptonews.

Advertisement

Source link

Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

Brent Crude Approaches $110 Amid Escalating Iran Tensions and Hormuz Blockade

Published

on

Brent Crude Oil Last Day Financ (BZ=F)

Key Highlights

  • Brent crude climbed close to $110 per barrel while WTI hit $96 amid escalating Middle East tensions through early April.
  • President Trump postponed the deadline for potential strikes on Iran’s energy sector until April 6, citing active diplomatic discussions.
  • Iranian officials have publicly rejected claims that negotiations with Washington are underway.
  • Approximately 8 million barrels daily remain unavailable due to the continued blockade of the Strait of Hormuz.
  • Energy analysts from Macquarie project oil could surge to $200 per barrel if hostilities persist beyond spring.

Global crude markets continue their sharp ascent as geopolitical strife involving the United States, Israel, and Iran throttles critical energy transport routes. Brent crude advanced nearly 2% to reach $109.92 per barrel during Friday trading. Meanwhile, U.S. West Texas Intermediate climbed to $96.08.

Brent Crude Oil Last Day Financ (BZ=F)
Brent Crude Oil Last Day Financ (BZ=F)

March appears set to deliver unprecedented gains for Brent crude. The benchmark has jumped approximately 52% throughout the month, representing one of the most dramatic monthly advances in modern energy trading history.

Hostilities erupted in late February and have resulted in the virtual shutdown of the Strait of Hormuz. This narrow maritime passage typically handles roughly 20% of the world’s petroleum shipments.

The strait’s closure has removed roughly 8 million barrels daily from international markets. Ole Hansen, Saxo Bank’s commodities strategy chief, noted that supply constraints are accelerating rapidly as vessels that departed Gulf ports before the crisis have completed their deliveries and offloaded their cargo.

President Trump pushed back the White House’s ultimatum for Iran to restore access to the strait or risk American military action against its energy infrastructure. April 6 now marks the revised deadline. Trump indicated that Iran requested the postponement and characterized ongoing discussions as productive.

Tehran contradicted this narrative through official channels. Iranian authorities stated that no diplomatic engagement with the United States is currently in progress.

Advertisement

Military Operations and Troop Deployments Expand

Combat operations have persisted throughout the region. Israeli forces announced they targeted a primary Iranian production center for missiles and naval mines located in Yazd. Kuwait confirmed drone strikes against two of its port facilities. Saudi authorities intercepted unmanned aircraft in the kingdom’s eastern provinces.

The Pentagon is evaluating the deployment of as many as 10,000 additional ground forces to the area, potentially including elements from the 82nd Airborne Division and Marine Expeditionary Units.

The Trump administration is simultaneously working to organize a diplomatic gathering in Pakistan scheduled for this weekend. Vice President JD Vance and additional high-ranking officials may participate in discussions aimed at identifying a pathway toward resolution.

Iranian leadership indicated it declined a 15-point American peace framework and presented alternative conditions. Tehran’s terms reportedly include formal acknowledgment of Iranian authority over the Strait of Hormuz.

Advertisement

Economic Ripple Effects and Global Market Reaction

The dramatic oil spike is amplifying wider economic anxieties. Government debt yields have climbed as market participants anticipate that elevated energy costs may compel monetary authorities to implement tighter policy.

The benchmark 10-year U.S. Treasury yield advanced to levels not observed since July. European bond markets in Germany and France experienced similar yield increases.

Numerous nations have implemented measures to cushion the impact on their populations. India reduced taxation on diesel and gasoline products. Vietnam implemented a temporary freeze on fuel-related levies through mid-April. New Zealand authorities documented evidence of consumer stockpiling of petroleum products.

Macquarie’s analytical team estimates a 40% probability that military confrontations will continue through June. Under that scenario, their forecasts suggest crude could reach $200 per barrel.

Advertisement

Two commercial container vessels operated by China’s Cosco Shipping made an attempt to transit the Strait of Hormuz on Friday but reversed course in proximity to Iranian territorial waters.

Source link

Advertisement
Continue Reading

Crypto World

Vietnam Arrests Suspects in ONUS Crypto Scheme Probe

Published

on

Vietnam Arrests Suspects in ONUS Crypto Scheme Probe

Vietnamese authorities have detained multiple ONUS-linked suspects after alleging they used false promotions and manipulated token trading to misappropriate investor funds through the crypto platform.

The Ministry of Public Security said Thursday that the investigation targeted a group accused of selling digital tokens through the Onus platform, using misleading promotions and coordinated trading activity to attract users. Authorities claim the group manipulated supply and demand and adjusted token prices, presenting the assets as legitimate investment opportunities while maintaining centralized control over their markets. 

Investigators named several suspects in the case, including Vuong Le Vinh Nhan, who is linked by Vemanti to XPLOR, the Singapore-based parent company of ONUS Pro; Tran Quang Chien, identified in Vietnamese reporting as the technical administrator of the ONUS exchange; and Ngo Thi Thao, director of HanaGold Jewelry JSC.

Authorities said the suspects are accused of creating and promoting tokens, including VNDC, ONUS and HNG, through the ONUS platform. Police say the scheme raised billions of dollars from investors. However, the authorities did not provide a breakdown of the losses. 

Advertisement

The case adds to scrutiny of crypto activity in Vietnam, one of the world’s most active retail digital asset markets.

Vietnam ranks fourth in Chainalysis’ crypto adoption index in 2025. Source: Chainalysis

Vietnam widens ONUS fraud probe

According to the Ministry of Public Security, the arrests follow a multi-agency investigation spanning several cities, with police summoning over 140 individuals for questioning and seizing evidence, as part of a broader effort to dismantle large-scale crypto-linked fraud operations. 

On Thursday, Vemanti said it learned of the indictments of Nhan Vuong and Chien Tran through the ministry announcement and Vietnamese media, and had engaged US legal counsel to assess the situation. Vemanti identified Vuong as chairman of its board and Tran as a board member.

Related: Indian court says ‘no case’ against CoinDCX founders in impersonation fraud

The ONUS platform presents itself as a digital asset ecosystem offering trading, staking and investment products, claiming more than seven million users and backing from the US-based fintech company Vemanti Group. 

Advertisement

Its official X account has more than 885,000 followers. However, market data aggregator CoinMarketCap lists the ONUS token with a self-reported market capitalization of around $25 million, highlighting a gap between the scale of alleged losses and publicly available token metrics.

Onus has not released an official statement addressing the situation.

Cointelegraph reached out to Onus for comment, but had not received a response by publication. 

ONUS token’s all-time price chart. Source: CoinMarketCap

India case points to wider scam network risks

In a separate case, India’s Central Bureau of Investigation said Thursday that it arrested a Mumbai-based suspect accused of helping traffic victims to scam compounds in Myanmar, where individuals were allegedly forced to carry out online fraud schemes, including crypto investment scams and romance scams.

The agency said victims were lured with job offers in Thailand before being diverted to scam centers in Myanmar’s Myawaddy region, where they were subjected to confinement, intimidation and abuse while being made to target victims globally.

Advertisement

Magazine: Banks want to run Vietnam’s crypto exchanges, Boyaa’s $70M BTC plan: Asia Express