Distributed via phishing emails or "freeware" links in YouTube descriptions and Discord servers. Typical Infection Cycle
Scrapes local LevelDB files to steal Discord authentication tokens, allowing attackers to bypass 2FA and take over accounts. Mercurial Grabber.exe
Fake "FiveM" cheats, Minecraft mods, or Roblox exploits. Cracked Software: Keygens or installers for paid software. Distributed via phishing emails or "freeware" links in
Specifically targets Minecraft (launch profiles) and Roblox (.ROBLOSECURITY cookies) to hijack gaming sessions. Mercurial Grabber.exe
