Vanta Stealer is a Python-based information stealer designed to collect credentials, cryptocurrency wallet data, gaming accounts, communication-platform sessions, and sensitive files from infected Windows devices.
Point Wild Threat Intelligence found that the malware uses layered packaging and obfuscation to make analysis more difficult and to delay detection.
The sample examined was a 64-bit Windows executable built with PyInstaller, a tool commonly used to bundle Python applications into standalone executables.
It was also protected with PyArmor, a commercial Python code-protection framework. This combination hides the malware’s core logic behind multiple layers and increases the effort required for static analysis.
Researchers identified the executable as a PyInstaller archive containing 216 embedded files. The archive included a key compiled Python module, main.pyc, which served as the primary application entry point.
Initial decompilation revealed PyArmor runtime components and an encrypted payload instead of readable source code.
After removing the PyArmor protection layer, researchers recovered the bytecode and analyzed Vanta Stealer’s execution flow.
Vanta Stealer Spreads Widely
The malware may be distributed through social-engineering lures rather than a single confirmed delivery method.
Potential infection routes include phishing attachments, trojanized installers, cracked software, fake browser or system updates, malicious GitHub-hosted projects, search-engine poisoning, and malvertising campaigns.
Game-focused lures may be especially effective because Vanta Stealer targets Steam, Riot Games, Roblox, Minecraft, and Valorant-related data.
Attackers could disguise the malware as cheats, mods, launchers, performance tools, or game utilities. Users downloading unofficial software from untrusted sources may unknowingly execute the stealer.
Vanta Stealer targets Chromium-based browsers and attempts to gather stored passwords, cookies, payment-card details, and other browser artifacts.
Browser data can expose online accounts, active sessions, and saved financial information.
Rather than relying only on its main payload, the malware can retrieve a separate browser-credential extractor at runtime, allowing operators to update browser-stealing capabilities without rebuilding the main malware.
The stealer also targets Discord and performs deeper profiling of stolen authentication tokens.
For each valid token, it can query Discord services to obtain account details such as usernames, email addresses, phone numbers, Nitro subscription status, linked billing information, and server administrative privileges.
This gives attackers more context than a raw token alone and helps them identify valuable accounts.
Other collection modules focus on Telegram Desktop, Steam, Roblox, Mullvad VPN, Riot Games-related files, cryptocurrency wallets, and sensitive local documents.
Vanta Stealer may also capture screenshots and webcam images. It searches for documents that could contain crypto-wallet recovery phrases, private keys, or other valuable information, pointwild said.
Indicators of Compromise
| IOC Type | Value |
|---|---|
| SHA-256 | 3bff25e745707056cf4ed6428ee8aace9a1bff2fb4030e32a7c0470a34cbfa62 |
| SHA-256 | 4bdf15157fc0067af179d11e9ad168816ce99a849fd45332482b0b88a05aeabb |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
