Back Gbhackers

Fake Certificate Loader Hides BlankGrabber Malware Chain

Gbhackers •Mayura Kathir • March 28, 2026

BlankGrabber’s operators are now abusing a fake “certificate” loader to hide a multi‑stage Rust and Python infection chain, making this commodity stealer significantly harder to spot on Windows endpoints. The new technique relies on built‑in tools such as certutil.exe, heavily obfuscated PyInstaller stubs, and stealthy exfiltration via Telegram and public web services to evade both […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

BlankGrabber Malware Exploits Fake Certificate Loader for Stealthy Attacks BlankGrabber's operators are utilizing a fake certificate loader to conceal a sophisticated multi-stage infection chain involving Rust and Python. This method leverages built-in Windows tools like certutil.exe and heavily obfuscated PyInstaller stubs to evade detection. The malware begins with a batch script hosted on Gofile.io, which downloads a Rust executable masquerading as a certificate. Once executed, it performs anti-sandbox checks and drops a self-extracting RAR archive containing a remote-access client and the BlankGrabber stealer. This enables attackers to conduct remote control and data theft simultaneously. The malware targets Windows endpoints and employs various evasion techniques to avoid detection by security tools. The operators use Telegram and public web services for stealthy exfiltration of stolen data. The threat is significant due to the malware's ability to extract sensitive information from browsers and system profiles. 3 sources 68

Extracted Entities

Fake Certificate Loader Hides BlankGrabber Malware Chain

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (3)

Platforms (1)

Tools (2)