A sophisticated Python-based malware family known as VVS Stealer has emerged as a significant threat to Discord users.
The stealer, actively marketed on Telegram beginning in April 2025, is engineered to exfiltrate sensitive account credentials, authentication tokens, and browser data from compromised systems.
Technical Composition and Obfuscation
VVS Stealer is developed in Python and distributed via PyInstaller packages. This method allows threat actors to bundle dependencies without requiring additional module installations.
The malware employs Pyarmor, an advanced obfuscation tool, to protect its code against static analysis and signature-based detection.
This sophisticated protection leverages AES-128-CTR encryption with 128-bit keys, ByteCode-to-Compilation (BCC) mode conversion, and encrypted string constants, making reverse engineering significantly more challenging for security researchers.
Analysis of sample c7e6591e5e021daa30f949a6f6e0699ef2935d2d7c06ea006e3b201c52666e07 reveals the malware incorporates a built-in expiration date of October 31, 2026, after which it terminates itself.
The stealer targets Discord through multiple attack vectors. It searches for encrypted Discord tokens within LevelDB directories, decrypts them using Windows Data Protection API (DPAPI), and extracts sensitive account information, including Nitro subscription status, payment methods, usernames, email addresses, phone numbers, and multifactor authentication status.
All exfiltrated data is transmitted via HTTP POST requests to attacker-controlled Discord webhook endpoints.
Beyond token theft, VVS Stealer performs active session hijacking by injecting obfuscated JavaScript code into Discord’s Electron application framework.
This injection establishes persistence and monitors network traffic through Chrome DevTools Protocol, capturing user actions related to password changes, backup code access, and payment method modifications.
The malware targets 19 web browsers, including Chrome, Firefox, Edge, and Brave, extracting cookies, passwords, browsing history, and autofill data, as reported by Paloalto Network.
It achieves persistence by copying itself to Windows startup directories and displays fake error messages to distract users during infection.
VVS Stealer exemplifies how legitimate development tools can be weaponized to steal credentials. The integration of advanced obfuscation techniques with multi-vector data exfiltration creates a perilous threat.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
