Loading story…
Attackers have weaponized the open-source Python red-teaming tool RedTiger to create an infostealer capable of compromising Discord accounts, stealing cryptocurrency wallet data, and exfiltrating payment information. The malware, distributed as standalone binaries with gaming or Discord-related names, scans infected systems for Discord and browser database files, extracts authentication tokens, and injects malicious JavaScript into Discord's codebase to intercept sensitive events such as logins and purchases. In addition to Discord credentials, the infostealer targets browser-stored passwords, cookies, credit card details, and game account data, with a particular focus on French Discord users.
RedTiger's infostealer component is being abused by threat actors despite its "legal use only" disclaimer on GitHub, as its free distribution and lack of safeguards facilitate malicious use. The malware builder bundled with RedTiger enables attackers to easily generate customized payloads, further increasing the risk of widespread abuse. Security researchers have observed the tool being used to compromise Discord accounts, steal cryptocurrency wallets, and harvest a wide range of personal and financial information from victims' systems.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Follow-up reporting said the infostealer weaponized a Python red-teaming tool, adding technical context on how the malware was built and used in attacks against Discord users and crypto wallet holders.
Security reporting described a malware campaign using a RedTiger-based infostealer to steal Discord accounts. The malware was also reported to target sensitive data such as cryptocurrency wallet information.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cyble Research Labs reported that an upgraded **Hazard Token Grabber** malware strain is being used at scale to steal user data, with a primary focus on **Discord** users. The Python-based information stealer, first observed in 2021, has been distributed freely on GitHub while a more advanced version has been marketed through Discord and a dedicated website. Researchers said they identified more than **2,000 related samples** in the wild, indicating broad circulation of the malware. The malware establishes persistence, disables Discord token protection, and exfiltrates stolen data through **Discord webhooks**. In addition to Discord tokens, it targets Chrome credentials and cookies, Roblox cookies, Windows product details, geolocation data, and information from more than 20 applications and browsers. Its feature set also includes anti-debugging and anti-virtual machine checks consistent with **MITRE ATT&CK `T1497.001`** system-check sandbox evasion techniques, helping it avoid analysis while harvesting victim data.
Aug 15, 2026
VVS Stealer, also known as VVS $tealer, is a Python-based infostealer malware that specifically targets Discord users to exfiltrate sensitive credentials, tokens, and browser data. The malware has been actively marketed on Telegram since April 2025 and is notable for its use of PyArmor, a legitimate Python obfuscation tool, to evade static analysis and signature-based detection. By employing techniques such as bytecode encryption, BCC mode (converting Python functions into compiled C code), and AES-128 encryption in CTR mode, VVS Stealer significantly complicates reverse engineering and analysis efforts by security professionals. Technical analyses reveal that the malware's obfuscation methods make it highly stealthy and effective, with its code protected against standard decompilers and string extraction. Security researchers have detailed the multi-step deobfuscation process required to analyze VVS Stealer, highlighting the growing trend of malware authors leveraging advanced obfuscation tools to bypass traditional security controls. Organizations are advised to employ advanced detection and prevention solutions to mitigate the risks posed by such sophisticated threats targeting popular platforms like Discord.
Jun 29, 2026
Threat actors have been using fake crack, keygen, pirated software, and bogus installer sites to infect users with information-stealing malware, often through SEO poisoning, redirect chains, and password-protected archives hosted on legitimate services such as MediaFire, Discord, and filesend.jp. Reported payloads include **RedLine**, **RecordBreaker**, **Cryptbot**, **CopperStealer**, **Lightning Stealer**, **FFDroider**, **ZingoStealer**, **LUMMASTEALER**, and **IDATLOADER**, with lures ranging from KMSpico activators and fake Telegram installers to cracked copies of TeamViewer, VueScan Pro, Movavi Video Editor, and other popular software. Several campaigns used anti-analysis techniques such as anti-VM checks, obfuscated loaders, process hollowing, DLL sideloading, and in-memory execution to evade detection. The malware families stole browser credentials, cookies, credit card data, Discord tokens, Telegram data, screenshots, desktop files, and cryptocurrency wallet information, while some also hijacked clipboard wallet addresses, redirected exchange traffic through malicious proxy settings, abused stolen Facebook and Instagram business accounts, or downloaded follow-on payloads such as miners and additional stealers. Researchers warned that these infections are often opportunistic because victims actively seek pirated software, but the resulting foothold can enable broader compromise, including persistence, backdoor access, VPN abuse, lateral movement, and resale of access to other criminals or ransomware operators.
Aug 15, 2026