Vanta Stealer Uses PyArmor to Steal Browser Passwords, Crypto Wallets and Discord Tokens

Vanta Stealer is a Python‑based, cross‑platform information stealer that uses layered PyArmor obfuscation on top of a PyInstaller‑packed executable to harvest browser passwords, crypto wallet data, Discord tokens, gaming accounts, VPN configs, and sensitive documents.

Vanta Stealer exemplifies the current shift toward Python for modular, easily maintainable malware, while abusing commercial protection frameworks like PyArmor to frustrate reverse engineering.

The analyzed sample is a 64‑bit PE (Windows Vista subsystem) compiled with Visual Studio 2022 and then wrapped with PyInstaller, which embeds the Python runtime and all required modules into a single executable.

Static inspection with Detect It Easy identifies a large PyInstaller CArchive, from which analysts recovered 216 embedded files and the main.pyc entry point via pyinstxtractor, confirming a standard PyInstaller packing workflow.

Decompilation of main.pyc does not yield readable source; instead, it reveals imports from pyarmor_runtime_000000 and an invocation of _pyarmor_, alongside a large encrypted byte string payload that PyArmor decrypts at runtime.

This design forces analysts to defeat PyArmor before any meaningful code review, illustrating how commodity software protection is being repurposed as an anti‑analysis layer in modern infostealers.

Once deobfuscated, the malware exhibits a clearly staged collect → package → identify → exfiltrate model designed to maximize the value of each compromised endpoint.

Rather than embedding browser theft logic directly, Vanta Stealer dynamically retrieves a dedicated browser credential extractor at runtime.

This modular approach allows operators to update browser‑harvesting capabilities independently of the main payload, reduces the need to re‑distribute full binaries, and complicates static signature‑based detection.

After the browser module executes, the core stealer orchestrates additional collection routines for Discord, Telegram Desktop, Steam, Riot/Valorant, Roblox, Minecraft, Mullvad VPN, and local cryptocurrency wallets, as well as screenshots, webcam captures, and documents containing seed phrases or private keys.

Point Wild Threat Intelligence leveraged PyArmor Static Unpack (OneShot) to strip the PyArmor layer and recover the original Python bytecode for main.pyc, enabling full reconstruction of Vanta Stealer’s execution graph, modules, and data flows.

A key differentiator of Vanta Stealer is its Discord account profiling stage. The malware does not simply exfiltrate raw Discord tokens; it validates each token against the Discord API to pull associated username, email, phone number, user ID, Nitro subscription status, linked payment methods, and server administrative privileges.

This enrichment transforms tokens into high‑fidelity victim profiles, enabling threat actors to prioritize accounts with financial value or elevated access rapidly.

Vanta Stealer Uses PyArmor

Concurrently, Vanta Stealer invokes targeted modules to harvest Steam artifacts, Roblox session data, Mullvad VPN configurations, Valorant/Riot Games data, and sensitive files it discovers on disk.

All collected artifacts including browser passwords, cookies, stored cards, gaming accounts, cryptocurrency wallet files, Telegram data, screenshots, Minecraft data, and documents are normalized into structured objects, preparing them for centralized packaging and exfiltration.

Before exfiltration, Vanta Stealer generates a Summary.txt report that inventories the compromised system in detail, recording counts of browser credentials, cookies, credit cards, Discord tokens and accounts, Steam files, wallets, Roblox and Telegram artifacts, screenshots, VPN configs, Valorant files, and sensitive documents.

This summary allows operators to quickly triage high‑value infections without manually parsing every artifact.

The stealer then calls create_complete_zip() to produce a consolidated ZIP archive containing system information, browser data, Discord profiles, gaming platform artifacts, VPN configurations, cryptocurrency wallets, and sensitive file collections.

Metadata fields, including a unique victim identifier (userId), username, and execution mode (hitType), are attached so backend operators can map each archive to specific victims or campaigns.

Finally, the archive and metadata are uploaded via HTTP POST to a hard‑coded C2 endpoint, with explicit response handling for success (HTTP 200) and oversized uploads (HTTP 413), indicating a managed backend with upload limits and operational telemetry.

While the analyzed sample does not embed its initial delivery mechanism, its packaging and target set strongly suggest distribution via social‑engineering‑driven lures: trojanized installers, cracked software, game cheats and mods, fake updates, poisoned repositories, and SEO/malvertising campaigns that entice users to execute a “legitimate” Python executable.

This pattern aligns with other recent PyArmor‑ and PyInstaller‑based stealers such as VVS Stealer, which similarly target Discord tokens and browser data while leveraging commercial obfuscation to bypass static detection.

By combining layered PyArmor obfuscation, modular Python architecture, runtime‑retrieved credential extractors, and enriched victim profiling, Vanta Stealer underscores how modern infostealers are evolving beyond simple credential theft.

The Point Wild analysis provides defenders and researchers with a detailed blueprint of these techniques, reinforcing the need to monitor for suspicious PyInstaller executables, obfuscated Python runtime artifacts.

Why use the 2026 Agentic SOC Buyer’s Guide? 8 Best Platforms Compared – Download the 2026 Buyer’s Guide