Mercurial Grabber.exe May 2026

It silently scans for the targeted files and browser databases.

Primarily uses Discord Webhooks to exfiltrate stolen data directly to an attacker-controlled Discord channel. Key Capabilities

The file is the compiled output of an open-source information stealer (infostealer) originally published on GitHub in 2021. While its creators claimed it was for "educational purposes," it has been widely adopted by threat actors to steal personal data from gamers and casual web users. Mercurial Grabber.exe

Fake "FiveM" cheats, Minecraft mods, or Roblox exploits. Cracked Software: Keygens or installers for paid software.

The user runs the .exe . It may show a fake error message or a simple GUI to appear legitimate. It silently scans for the targeted files and

Use reputable tools like Malwarebytes or Windows Defender to locate and remove the executable and its registry entries.

Extracts stored passwords, cookies, and autofill data from popular browsers like Google Chrome, Opera, Brave, and Yandex . While its creators claimed it was for "educational

Attackers rarely name the file "Mercurial Grabber.exe" when sending it to victims. Instead, they disguise it as: