Torg Grabber infostealer targets 850+ browser extensions and crypto wallets. Silver Fox shifts from RATs to a WhatsApp-themed Python stealer. Dragon Breath (APT-Q-27) deploys a Farfli backdoor via fake screenshot links to Web3 support teams.