Fake Certificate Loader Hides BlankGrabber Malware Chain

**Executive Summary:** Splunk STRT details an active BlankGrabber campaign that abuses certutil to install a Rust stager masquerading as a certificate, unpacks a PyInstaller‑packed infostealer (BlankGrabber) alongside an XWorm backdoor, performs extensive anti‑sandbox and environment checks, harvests credentials/cookies/crypto wallets and other sensitive data, and exfiltrates via Telegram and public file services while establishing persistence and disabling Defender; multiple detections and SHA256 IOCs are provided.