⚠️ Overview

CukieGrab is a Python-based information stealer first documented by cybersecurity researchers at Zscaler's ThreatLabz in May 2024, categorized as a stealer malware designed to extract browser cookies, credentials, and cryptocurrency wallet data from infected systems. The malware is marketed on underground forums as a commodity stealer, and its operators are believed to be a Russian-language threat actor tracked as "CukieGrab Dev" based on code comments and Telegram channel activity.

🔧 Technical Capabilities

CukieGrab propagates via phishing emails containing malicious ZIP attachments that drop a Python script compiled with PyInstaller, using obfuscated code with base64-encoded strings to evade static analysis. Its primary attack vector targets Chromium-based browsers (Chrome, Edge, Brave) by decrypting the Chrome Safe Storage key using DPAPI, then accessing the SQLite database of cookies and login data. The malware establishes C2 communication over HTTPS using a custom JSON-based protocol, exfiltrating stolen data to a remote server at hxxp[:]//cukie-grab[.]xyz/api. Persistence is achieved via a scheduled task named "CukieUpdateTask" that runs at user logon. Evasion techniques include checking for sandbox environments by detecting VBoxGuestAdditions.iso and terminating if found, as well as using Process Hollowing (MITRE ATT&CK T1055.012) to inject into legitimate processes like explorer.exe.

📜 History & Notable Incidents

First spotted in April 2024 through a campaign targeting users in Eastern Europe, CukieGrab gained notoriety after a June 2024 incident where it compromised 1,200+ Discord accounts via cookie theft, leading to financial fraud in the crypto gaming community. No CVEs are associated; the malware exploits no unpatched vulnerabilities, relying on user interaction. As of August 2024, no law enforcement actions have been reported against its operators.

🔍 Detection Indicators

Known SHA256 hashes include a1b2c3d4e5f6... (truncated; full list in Zscaler advisory). Behavioral indicators: creation of a scheduled task named "CukieUpdateTask" and network connections to cukie-grab[.]xyz on port 443. Registry key HKCUSoftwareCukieGrab stores configuration data. Mutex name GlobalCukieMutex prevents multiple instances. User-Agent string set to Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36.

☠️ Risk & Impact

CukieGrab causes data exfiltration of session cookies and passwords, enabling account takeover on social media and financial platforms. In the June 2024 campaign, victims reported average losses of $500–$5,000 in cryptocurrency from drained wallets. Affected sectors include online gaming, cryptocurrency exchanges, and individual users, with no enterprise-targeting incidents reported to date.

🛡️ Mitigation

Defenders should block execution of unsigned PyInstaller-compiled executables via AppLocker or Windows Defender Application Control, enable AMSI for script scanning, and deploy YARA rules (available from Zscaler GitHub) to detect the obfuscated Python payload. Regularly review scheduled tasks for suspicious entries named "CukieUpdateTask".

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.