Customizable Stealer Builder Automates Large-Scale Windows Data Theft
Security researchers have uncovered a Python-based malware builder capable of generating customized Windows information stealers that harvest browser credentials, payment information, session cookies and other sensitive data.
K7 Labs discovered the framework while analyzing a suspicious RAR archive containing a nested package named TokenGrabberBuilder.zip.
Inside, researchers found two core components: a Python builder and an embedded credential-stealing payload. The architecture resembles a Malware-as-a-Service (MaaS) model, lowering the technical barrier for operators to create individualized malware samples.
Builder Automates Malware Creation
The framework separates payload development from deployment, allowing different operators to generate customized versions from the same underlying codebase.
Nuitka Complication Raises the Analysis Barrier
Operators can produce malware using Nuitka, PyInstaller or raw Python.
Nuitka is particularly significant because it translates Python through C into native machine code. Unlike PyInstaller packages, this removes conventional .pyc artifacts and makes standard Python decompilation considerably less useful.
Individual Webhooks Fragment Infrastructure Indicators
Operators supply a Discord or Telegram webhook used for exfiltration.
The builder XOR-encodes the address with the fixed key 0x5A, applies Base64 encoding and injects the result into the generated payload.
Consequently, different operators can produce binaries containing different encoded infrastructure and potentially different hashes, reducing the effectiveness of simple IOC-based clustering.
Stealer Raids Browser Security Stores
Once executed, the payload searches Windows profile directories for data belonging to 17 Chromium-based browsers, while Firefox is targeted separately.
DPAPI and AES-Protected Secrets Are Decrypted
For Chromium environments, the malware extracts the encrypted master key from the browser's Local State file and attempts to unlock it through Windows DPAPI.
It copies locked SQLite databases into temporary storage before extracting saved usernames and passwords, browsing history, payment-card information and cookies.
Newer Chromium records protected with AES-256-GCM are decrypted with the recovered master key, while older entries can be processed using DPAPI directly.
Session Cookies Create a Passwordless Hijacking Risk
The malware also extracts browser session material.
This is particularly dangerous because stolen authenticated cookies can potentially allow attackers to assume an existing web session without first obtaining or re-entering the victim's password.
Firefox history and cookies are harvested from its SQLite profile databases as well.
Attack Extends Beyond Web Credentials
Browser information represents only one part of the collection operation.
Wi-Fi, Discord and Roblox Secrets Are Targeted
The stealer invokes Windows netsh commands to enumerate stored Wi-Fi profiles and retrieve cleartext wireless keys.
It also searches Discord's LevelDB storage for authentication tokens, decrypts protected entries and validates potential tokens against Discord's API before exfiltration.
.ROBLOSECURITY session cookies are harvested and checked as another source of authenticated access.
Dual Persistence Keeps the Implant Active
The malware uses two independent persistence mechanisms.
WindowsUpdate Name Conceals Registry Persistence
A Registry Run entry is created under:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
The value is misleadingly named WindowsUpdate to resemble legitimate system activity.
A separate ONLOGON scheduled task provides a second execution mechanism whenever the victim signs in.
Anti-Analysis Logic Screens Research Environments
The payload also attempts to determine whether it is running inside a security-analysis environment.
Debuggers, Virtual Machines and Small Disks Trigger Evasion
K7 identified checks for attached debuggers, virtualization-related processes and systems with less than 50 GB of disk capacity.
Variable sleep timing can further complicate short-lived sandbox analysis.
Stolen Data Leaves Memory Through Webhooks
Collected information is assembled into a ZIP archive using Python's BytesIO, allowing the package to be constructed in memory rather than written as a conventional archive to disk.
The resulting collection includes credentials alongside system information such as the victim's public IP, location, username and computer name before being transmitted through an attacker-controlled webhook.
Behavioral Detection Becomes More Important Than Hashes
The architecture demonstrates why defenders cannot rely exclusively on malware signatures.
Useful detection opportunities include unexpected pip.exe activity, unauthorized access to browser credential databases, netsh wlan enumeration, suspicious Run-key or scheduled-task creation, and unusual HTTP POST traffic toward webhook infrastructure.
More broadly, the framework demonstrates how MaaS is turning sophisticated credential theft into a configurable product: operators no longer need to engineer every component themselves when a builder can automate compilation, persistence, credential harvesting and exfiltration.