BoryptGrab Malware Abuses GitHub to Steal Browser and Crypto Wallet Data

BoryptGrab is an active Windows information‑stealer campaign that uses SEO‑poisoned fake GitHub repositories to trick users into downloading malicious ZIPs which deploy layered downloaders and side‑loading chains to install stealers (and sometimes Vidar variants) and a TunnesshClient SSH backdoor; it targets browser credentials, desktop and extension cryptocurrency wallets, Telegram/Discord data, screenshots and user files, and exfiltrates collected data to attacker servers, with observable indicators like build names (Shrek, CryptoByte, etc.) and specific beaconing ports.