Back Cybersecuritynews

New Torg Grabber Stealer Moves From Telegram Exfiltration to Encrypted REST API C2

Cybersecuritynews •Tushar Subhra Dutta • March 26, 2026

A new Malware-as-a-Service (MaaS) credential stealer named Torg Grabber has surfaced, showing remarkable development pace over just three months. Starting with simple Telegram-based data exfiltration, it matured into a fully encrypted REST API command-and-control (C2) infrastructure. With 334 samples compiled in that short period and more than 40 confirmed operator tags found in the binaries, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Torg Grabber Malware Evolves to Encrypted REST API for C2 Operations Torg Grabber, an information-stealing malware, has transitioned from using Telegram for data exfiltration to a more sophisticated encrypted REST API command-and-control (C2) channel, now utilizing Cloudflare for obfuscation. This malware, initially identified as a variant of Vidar, has demonstrated rapid evolution, with 334 samples compiled in just three months and over 40 confirmed operator tags found within its binaries. The malware primarily targets credentials and sensitive information, affecting various systems and users. The shift to a more secure C2 infrastructure indicates a significant advancement in its operational capabilities, raising concerns among cybersecurity professionals. The malware's development pace suggests a well-organized operation behind it, potentially posing a high risk to organizations that may fall victim to its tactics. Current status indicates ongoing monitoring and analysis as the threat landscape evolves. 2 sources 67

New Torg Grabber Stealer Moves From Telegram Exfiltration to Encrypted REST API C2

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)