Vanta Stealer Exposed: Python Malware Steals Crypto, Discord, Gaming Data via PyArmor

A newly documented information stealer dubbed Vanta Stealer is quietly redefining what “credential theft” means for everyday users. Uncovered by Point Wild’s Lat61 Threat Intelligence Team, researchers Prathamesh Shingare and Kedar Shashikant Pandit found

The malware doesn’t just skim browser passwords; it systematically strips a victim’s digital life bare, from cryptocurrency wallets and gaming accounts to VPN configurations and webcam captures, all while hiding behind commercial-grade code protection.

Vanta Stealer arrives as a standard-looking 64-bit Windows executable, but peeling back its layers reveals a deliberately engineered chain of obfuscation.

Vanta Stealer Exposed

Analysts used Detect It Easy to fingerprint the binary, then pyinstxtractor to crack open its PyInstaller CArchive, an 80MB package containing 216 embedded files built for Python 3.10. Buried inside was the true payload: a compact 32KB file named main.pyc.

Decompiling that file didn’t yield readable code. Instead, it exposed a second defensive layer: PyArmor obfuscation, evident in telltale imports such as pyarmor_runtime_000000 and a _pyarmor_ bootstrap call.

Researchers had to apply PyArmor Static Unpack (OneShot) to strip this protection before the malware’s actual logic became visible a layered defense-in-depth approach increasingly common among Python malware authors looking to slow down reverse engineers.

Vanta Stealer Exposed: Python Malware Steals Crypto, Discord, Gaming Data via PyArmor

What sets Vanta Stealer apart is its architecture. Rather than bundling all theft functions into a single payload, it downloads a dedicated browser-credential extractor at runtime, allowing operators to update harvesting capabilities without modifying the core malware.

It then fires off separate modules targeting Steam, Roblox, Mullvad VPN, Valorant, cryptocurrency wallets, and locally stored sensitive documents, including files that might contain wallet recovery phrases.

Its Discord targeting is particularly aggressive. Instead of just grabbing authentication tokens, the malware validates each one against the Discord API, pulling usernames, emails, phone numbers, Nitro subscription status, linked payment methods, and server administrative privileges, turning a stolen token into a complete victim profile.

Once collection wraps up, Vanta Stealer compiles a Summary.txt inventory that logs exactly what it stole: password counts, wallet files, screenshots, and gaming data, giving operators a quick snapshot of a victim’s value without manual review.

Everything is then zipped using the create_complete_zip() function and uploaded to a command-and-control server via an HTTP POST request, with tags including a unique victim ID, username, and execution mode. The malware even checks for HTTP 413 errors, suggesting a managed backend with upload size limits.

The sample doesn’t reveal its delivery method directly, but its design points to social engineering: phishing attachments, trojanized installers, fake software updates, malicious game mods and cheats, poisoned search results, and even booby-trapped code repositories are all plausible vectors given the applications it targets.

Point Wild notes that its UltraAV product is built to catch these threats at the initial access stage before trojanized installers or malvertising links can execute.

As Python-based stealers like Vanta continue blending commercial obfuscation tools with expansive data-harvesting modules, layered endpoint defense and cautious software sourcing remain a user’s best safeguard against becoming the next entry in an attacker’s Summary.txt file.