Mercurial | Grabber.exe

The user runs the .exe . It may show a fake error message or a simple GUI to appear legitimate.

Extracts stored passwords, cookies, and autofill data from popular browsers like Google Chrome, Opera, Brave, and Yandex .

Some variants copy themselves to %APPDATA%\Local\Temp and add a registry key to ensure they run every time the computer reboots.

Includes basic anti-debugging and anti-VM (Virtual Machine) checks to detect if it is being run by a security researcher in a sandbox. Delivery Methods