Loading story…
VVS Stealer, also known as VVS $tealer, is a Python-based infostealer malware that specifically targets Discord users to exfiltrate sensitive credentials, tokens, and browser data. The malware has been actively marketed on Telegram since April 2025 and is notable for its use of PyArmor, a legitimate Python obfuscation tool, to evade static analysis and signature-based detection. By employing techniques such as bytecode encryption, BCC mode (converting Python functions into compiled C code), and AES-128 encryption in CTR mode, VVS Stealer significantly complicates reverse engineering and analysis efforts by security professionals.
Technical analyses reveal that the malware's obfuscation methods make it highly stealthy and effective, with its code protected against standard decompilers and string extraction. Security researchers have detailed the multi-step deobfuscation process required to analyze VVS Stealer, highlighting the growing trend of malware authors leveraging advanced obfuscation tools to bypass traditional security controls. Organizations are advised to employ advanced detection and prevention solutions to mitigate the risks posed by such sophisticated threats targeting popular platforms like Discord.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 published a detailed report on January 2, 2026 describing how VVS Stealer uses PyInstaller packaging and PyArmor obfuscation, including BCC mode and AES-128-CTR encryption, to evade analysis. The report also shared indicators of compromise such as sample hashes and Discord webhook URLs used for exfiltration.
Analysis of VVS Stealer revealed it steals Discord tokens and account data, injects malicious JavaScript into the Discord client to hijack sessions, and harvests browser cookies, passwords, history, and autofill data. The malware also establishes persistence via the Windows Startup folder, uses fake error pop-ups to distract victims, and exfiltrates stolen data through Discord webhooks and HTTP POST.
VVS Stealer, a Python-based infostealer targeting Discord users, was being sold on Telegram by at least April 2025 using low-cost subscription and lifetime-license offerings. Reporting also links its operation to French-speaking actors active in stealer-related communities.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcesecurityonline.info
Open sourcethehackernews.com
Open sourcesecurityaffairs.com
Open sourcecybersecuritynews.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **Vanta Stealer**, a Python-based information-stealing malware for Windows that rapidly collects a wide range of data from infected systems. The malware is packaged with **PyInstaller** and obscured with multiple **PyArmor** layers, then uses a modular design that can download a dedicated browser extractor during execution. Reported targets include Chromium-based browsers, stored credentials, cookies, payment data, Discord tokens, Steam, Roblox, Riot Games, Valorant, Minecraft, Telegram Desktop, Mullvad VPN, cryptocurrency wallet files and recovery material, private documents, screenshots, and webcam images. After harvesting data, Vanta Stealer logs the results in `Summary.txt`, compresses the stolen files into a ZIP archive, and sends the archive with victim metadata to a predefined command-and-control endpoint over HTTP POST. Reporting on the malware said likely delivery methods include phishing attachments, fake installers, cheats, bogus software updates, tampered code repositories, and malicious search ads, and noted that defenders should watch for unusual archive uploads and restrict unapproved software while affected users reset passwords, revoke sessions, and review wallet exposure from a clean device.
Aug 6, 2026
Researchers reported that updated **Vidar** infostealer campaigns are using steganography, fileless execution, and social-engineering lures to evade detection and steal corporate and consumer data. Point Wild and Intrinsec found infections delivered through fake GitHub repositories, compromised WordPress sites showing **ClickFix**-style fake CAPTCHA prompts, gaming cheat posts on Reddit and Discord, and bogus software promoted in YouTube videos and hosted on services such as Mediafire. In one chain, a fake tool named **NeoHub** dropped a malicious DLL disguised as a Microsoft Edge component and signed with counterfeit certificates impersonating GitHub and grow.com. The malware uses VBScript, obfuscated PowerShell, a Go-based loader, and trusted Windows binaries including `WScript`, `PowerShell`, and `RegAsm.exe` to fetch apparently harmless JPEG and TXT files that contain hidden Base64-encoded second-stage payloads, then reconstructs and executes them entirely in memory through .NET reflective loading. Researchers said Vidar now operates as a **Malware-as-a-Service** offering, uses Telegram and Dead Drop Resolver techniques via public Steam profiles to locate command-and-control infrastructure, and exfiltrates credentials, cookies, payment data, cryptocurrency wallet files, and information from more than 200 browser extensions, often through Telegram and Cloudflare-fronted domains to mask attacker activity.
Jun 29, 2026
Threat researchers reported a new **Python-based Windows information-stealing malware** dubbed **SolyxImmortal** that emphasizes *stealth and long-term persistence* over destructive actions. The implant is described as a “monolithic” package (not modular), delivered as a legitimate-looking Python script (e.g., `Lethalcompany.py`), and runs quietly in the background to harvest sensitive data including credentials, documents, keystrokes, and screenshots. SolyxImmortal’s command-and-control and exfiltration model relies on **Discord webhooks**, abusing trusted HTTPS traffic to blend in and reduce network-based detection. Reporting attributes the analysis to **CYFIRMA**, noting that C2 parameters are hardcoded and that operators can receive real-time notifications (including via a hardcoded Discord user ID) for high-value events; separate webhooks may be used for different data types (e.g., logs/files vs. screenshots). The malware targets browser-stored data (including Chromium-based browsers such as Chrome, Edge, Brave, and Opera GX) and focuses on single-host surveillance rather than lateral movement.
Jun 29, 2026