Gryxa: The AI-Built Toolkit That Watches How You Remove It

ReliaQuest reports on "Gryxa," an AI-assisted toolkit used by a financially motivated actor to covertly convert RMM software into persistent access across hundreds of Windows hosts, steal Chromium-saved credentials and identify wallet extensions, and survive partial remediation via layered scheduled tasks, a WMI event subscription, and off-path file backups; Gryxa also attempts to disable or uninstall endpoint protection if its relay is blocked, and exfiltrates stolen credentials via Telegram, so defenders should block actor infrastructure first, remove all persistence in one pass, rotate exposed credentials, and prioritize behavior-based detection.