Torg Grabber Malware Shifts from Telegram Exfiltration to Encrypted REST API for C2

Torg Grabber is a fast‑evolving information‑stealing malware family deployed via pirated installers and polymorphic loaders that keeps its core stealer off disk; it has transitioned from Telegram-based exfiltration to an encrypted HTTPS REST API C2 fronted by Cloudflare and operated as a Malware‑as‑a‑Service. The stealer reflectively maps a PE into memory, bypasses browser ABE to recover AES master keys, harvests credentials/cookies from many Chromium and Firefox variants, extracts cryptocurrency wallets and extension data, and fingerprints hosts during registration; researchers mapped multiple rotating C2 domains, operator tags linking to Russian‑language cybercrime accounts, and recommended detections such as TLS inspection and REST‑pattern monitoring.