Inside the Rapid Evolution of the BlankGrabber Stealer

**Executive Summary:** Splunk Threat Research Team analyzes BlankGrabber, a rapidly evolving, modular Python infostealer distributed via social engineering and weaponized GitHub/Discord artifacts; it uses a certutil-based multi-stage loader, exfiltrates browser credentials, Discord tokens and system metadata, and sends stolen data via Telegram bot C2 or uploads to public file hosts, often packaging results in password-protected archives to hinder analysis.