Grabber.exe - Mercurial

Specifically targets Minecraft (launch profiles) and Roblox (.ROBLOSECURITY cookies) to hijack gaming sessions.

Collects machine info, including Windows product keys, IP addresses, hardware specs, and desktop screenshots. Mercurial Grabber.exe

Written in C# (C Sharp) using the .NET framework, making it relatively easy to reverse-engineer if it isn't obfuscated. Attackers rarely name the file "Mercurial Grabber

Attackers rarely name the file "Mercurial Grabber.exe" when sending it to victims. Instead, they disguise it as: The file is the compiled output of an

Prioritize Discord, email, and gaming accounts. If you have 2FA enabled, your session tokens might still be at risk until you log out of all sessions.

The file is the compiled output of an open-source information stealer (infostealer) originally published on GitHub in 2021. While its creators claimed it was for "educational purposes," it has been widely adopted by threat actors to steal personal data from gamers and casual web users.