BlankGrabber — Malware Profile
BlankGrabber is an information stealer written in Python 3 and typically distributed bundled via PyInstaller as a Windows executable. Released as an open-source project on GitHub in 2022, it ships with a graphical builder that lets operators without Python knowledge produce customised variants, and its code is obfuscated with the project's own BlankOBF obfuscator. It harvests browser passwords, cookies, history and autofill data, Discord tokens, Telegram sessions, cryptocurrency wallets, WiFi passwords, gaming-platform credentials from Steam, Epic Games and Roblox, plus system information, screenshots and webcam captures, compressing the results with an embedded rar.exe into a single archive that is exfiltrated over Discord webhooks or an encoded Telegram bot. Before collection it disables Windows Defender and adds its payload directory to the exclusion list, and it checks for blacklisted usernames, computer names, UUIDs and tasks; Splunk's Security Research Team documented a loader chain that used certutil to decode a Rust stager and dropped BlankGrabber alongside the XWorm RAT.