BlankGrabber Stealer Uses Fake Certificate Loader to Hide Malware Delivery Chain

BlankGrabber is a Python-based infostealer that uses a deceptive certutil-based batch loader and multi-stage obfuscation to deliver an AES-encrypted Python payload and the XWorm RAT; it targets browser credentials, session tokens, wallets, clipboard data, screenshots and more, employs anti-sandbox/virtualization checks, disables Windows Defender, modifies hosts for evasion, and persists via startup — distributed via social engineering (cracked software, Discord, fraudulent GitHub). Defenders should look for certutil decoding non-certificate data, anomalous WinRAR activity, PowerShell commands disabling Defender, startup persistence, and connections to file-sharing or Telegram APIs.