Vanta Stealer Harvests Browser Credentials, Crypto Wallets, and Gaming Accounts

Researchers detailed Vanta Stealer, a Python-based information-stealing malware for Windows that rapidly collects a wide range of data from infected systems. The malware is packaged with PyInstaller and obscured with multiple PyArmor layers, then uses a modular design that can download a dedicated browser extractor during execution. Reported targets include Chromium-based browsers, stored credentials, cookies, payment data, Discord tokens, Steam, Roblox, Riot Games, Valorant, Minecraft, Telegram Desktop, Mullvad VPN, cryptocurrency wallet files and recovery material, private documents, screenshots, and webcam images.

After harvesting data, Vanta Stealer logs the results in Summary.txt, compresses the stolen files into a ZIP archive, and sends the archive with victim metadata to a predefined command-and-control endpoint over HTTP POST. Reporting on the malware said likely delivery methods include phishing attachments, fake installers, cheats, bogus software updates, tampered code repositories, and malicious search ads, and noted that defenders should watch for unusual archive uploads and restrict unapproved software while affected users reset passwords, revoke sessions, and review wallet exposure from a clean device.