Malware

Vanta Stealer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence2

Phishing attachments, fake software installers, game cheats, altered code repositories, bogus updates and malicious search ads may all persuade a user to run it

Execution

2 techniques

T1204User ExecutionEvidence1

users may execute a file that looks legitimate before its collection routines begin

T1204.002Malicious FileEvidence1

Phishing attachments, fake software installers, game cheats, altered code repositories, bogus updates and malicious search ads may all persuade a user to run it

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

identified the malware as a Python-based stealer wrapped with PyInstaller and protected by several PyArmor layers. That packaging makes the program harder to inspect

T1036MasqueradingEvidence1

users may execute a file that looks legitimate before its collection routines begin

Credential Access

3 techniques

T1539Steal Web Session CookieEvidence2

Vanta Stealer targets Chromium-based browsers for passwords, cookies and stored payment information... Stolen cookies may also let an intruder reuse an active browser session, bypassing the need to know a password in some cases.

T1555Credentials from Password StoresEvidence2

Vanta Stealer targets Chromium-based browsers for passwords, cookies and stored payment information

T1649Steal or Forge Authentication CertificatesEvidence1

The malware also collects Discord tokens and checks them against the service’s API to obtain account details

Collection

4 techniques

T1005Data from Local SystemEvidence2

It reaches far beyond saved browser passwords, pulling cookies, payment details, account tokens, wallet files and private documents into one collection.

T1113Screen CaptureEvidence2

The malware can also capture screenshots and webcam images, adding context to the files and credentials it gathers.

T1125Video CaptureEvidence2

The malware can also capture screenshots and webcam images, adding context to the files and credentials it gathers.

T1560Archive Collected DataEvidence2

It records totals in Summary.txt before creating a ZIP archive... Once it finishes gathering data, Vanta creates a compressed archive containing system information and the stolen material.

Exfiltration

1 technique

T1048.003Exfiltration Over Unencrypted Non-C2 ProtocolEvidence2

It sends the archive and victim-specific metadata, including a user identifier, username and execution mode, to a predefined command-and-control endpoint through an HTTP POST request.

INDICATORS OF COMPROMISE

IOCs tracked for this family

19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

19 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cryptika blogNews

Aug 6, 2026

Vanta Stealer Empties Browser Vaults, Crypto Wallets and Gaming Accounts in Minutes | Cryptika Cybersecurity

A Python-based stealer packaged with PyInstaller and protected by PyArmor that steals browser passwords, cookies, payment details, account tokens, wallet files, private documents, Discord tokens, gaming account data, Telegram Desktop artifacts, Mullvad VPN configurations, screenshots, and webcam images, then compresses and exfiltrates the data to a command-and-control endpoint via HTTP POST.

cyber security newsNews

Aug 6, 2026

Vanta Stealer Empties Browser Vaults, Crypto Wallets and Gaming Accounts in Minutes

Python-based information stealer packaged with PyInstaller and protected by PyArmor. It steals browser passwords, cookies, payment details, account tokens, wallet files, private documents, Discord tokens, gaming account data, Telegram artifacts, Mullvad VPN configurations, and can also capture screenshots and webcam images before archiving and exfiltrating the data to a C2 endpoint via HTTP POST.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching19

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Vanta Stealer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence2

Phishing attachments, fake software installers, game cheats, altered code repositories, bogus updates and malicious search ads may all persuade a user to run it

Execution

2 techniques

T1204User ExecutionEvidence1

users may execute a file that looks legitimate before its collection routines begin

T1204.002Malicious FileEvidence1

Phishing attachments, fake software installers, game cheats, altered code repositories, bogus updates and malicious search ads may all persuade a user to run it

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

identified the malware as a Python-based stealer wrapped with PyInstaller and protected by several PyArmor layers. That packaging makes the program harder to inspect

T1036MasqueradingEvidence1

users may execute a file that looks legitimate before its collection routines begin

Credential Access

3 techniques

T1539Steal Web Session CookieEvidence2

T1555Credentials from Password StoresEvidence2

Vanta Stealer targets Chromium-based browsers for passwords, cookies and stored payment information

T1649Steal or Forge Authentication CertificatesEvidence1

The malware also collects Discord tokens and checks them against the service’s API to obtain account details

Collection

4 techniques

T1005Data from Local SystemEvidence2

It reaches far beyond saved browser passwords, pulling cookies, payment details, account tokens, wallet files and private documents into one collection.

T1113Screen CaptureEvidence2

The malware can also capture screenshots and webcam images, adding context to the files and credentials it gathers.

T1125Video CaptureEvidence2

The malware can also capture screenshots and webcam images, adding context to the files and credentials it gathers.

T1560Archive Collected DataEvidence2

It records totals in Summary.txt before creating a ZIP archive... Once it finishes gathering data, Vanta creates a compressed archive containing system information and the stolen material.

Exfiltration

1 technique

T1048.003Exfiltration Over Unencrypted Non-C2 ProtocolEvidence2

It sends the archive and victim-specific metadata, including a user identifier, username and execution mode, to a predefined command-and-control endpoint through an HTTP POST request.

INDICATORS OF COMPROMISE

IOCs tracked for this family

19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

19 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cryptika blogNews

Aug 6, 2026

Vanta Stealer Empties Browser Vaults, Crypto Wallets and Gaming Accounts in Minutes | Cryptika Cybersecurity

cyber security newsNews

Aug 6, 2026

Vanta Stealer Empties Browser Vaults, Crypto Wallets and Gaming Accounts in Minutes

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching19

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.