Loading story…
Researchers detailed Vanta Stealer, a Python-based information-stealing malware for Windows that rapidly collects a wide range of data from infected systems. The malware is packaged with PyInstaller and obscured with multiple PyArmor layers, then uses a modular design that can download a dedicated browser extractor during execution. Reported targets include Chromium-based browsers, stored credentials, cookies, payment data, Discord tokens, Steam, Roblox, Riot Games, Valorant, Minecraft, Telegram Desktop, Mullvad VPN, cryptocurrency wallet files and recovery material, private documents, screenshots, and webcam images.
After harvesting data, Vanta Stealer logs the results in Summary.txt, compresses the stolen files into a ZIP archive, and sends the archive with victim metadata to a predefined command-and-control endpoint over HTTP POST. Reporting on the malware said likely delivery methods include phishing attachments, fake installers, cheats, bogus software updates, tampered code repositories, and malicious search ads, and noted that defenders should watch for unusual archive uploads and restrict unapproved software while affected users reset passwords, revoke sessions, and review wallet exposure from a clean device.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Point Wild released an analysis of Vanta Stealer, describing it as a Python-based information stealer packaged with PyInstaller and protected by multiple PyArmor layers. The report detailed its modular theft capabilities, Windows targeting, exfiltration behavior, and published indicators of compromise including SHA-256 hashes.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcepointwild.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **Bandit Stealer**, a Go-based information stealer for Windows that collects browser credentials, cookies, history, credit card data, cryptocurrency wallet contents, Telegram sessions, FTP and email client logins, keystrokes, clipboard data, and host profiling information. The malware attempts privilege escalation with `runas.exe`, establishes persistence through the Windows **Run** registry key, and stores stolen data in `%appdata%\local` subfolders named with the victim’s country code and IP address before archiving and exfiltrating the loot through the **Telegram Bot API**. Bandit Stealer also uses extensive anti-analysis and sandbox-evasion checks to avoid detection, inspecting virtualization and security processes, debugger presence, blacklisted IP addresses, MAC addresses, hardware IDs, usernames, and computer names, and terminating when it detects likely research environments. Researchers said the malware has been delivered through self-extracting archive droppers disguised as benign documents or installers, including decoy Word, OpenVPN-related, and fake Heartsender files, while embedded Linux paths and commands suggest the codebase may still be evolving or could expand beyond Windows.
Aug 15, 2026
Researchers identified **SvcStealer** as a new information-stealing malware family distributed through spear-phishing attachments and active since early 2025. Written in Microsoft Visual C++, the malware collects system details, installed software inventories, browser data, saved credentials, cryptocurrency wallet information, messaging app data, screenshots, and selected files before compressing the haul and exfiltrating it over HTTP `POST` traffic on port 80 to command-and-control infrastructure designed to blend in with normal web activity. Analysis linked the malware to infrastructure including `176.113.115.149`, `185.81.68.156`, and the path `/svcstealer/get.php`, while reporting that some associated domains were unreachable during investigation. SvcStealer also uses anti-analysis and evasion techniques such as killing Task Manager and process inspection tools, enforcing a single running instance using a victim identifier derived from the host volume serial number, deleting traces after exfiltration, and downloading additional payloads for follow-on compromise; MalwareBazaar has tracked **125** related samples, with sightings extending into August 2026.
Aug 15, 2026
VVS Stealer, also known as VVS $tealer, is a Python-based infostealer malware that specifically targets Discord users to exfiltrate sensitive credentials, tokens, and browser data. The malware has been actively marketed on Telegram since April 2025 and is notable for its use of PyArmor, a legitimate Python obfuscation tool, to evade static analysis and signature-based detection. By employing techniques such as bytecode encryption, BCC mode (converting Python functions into compiled C code), and AES-128 encryption in CTR mode, VVS Stealer significantly complicates reverse engineering and analysis efforts by security professionals. Technical analyses reveal that the malware's obfuscation methods make it highly stealthy and effective, with its code protected against standard decompilers and string extraction. Security researchers have detailed the multi-step deobfuscation process required to analyze VVS Stealer, highlighting the growing trend of malware authors leveraging advanced obfuscation tools to bypass traditional security controls. Organizations are advised to employ advanced detection and prevention solutions to mitigate the risks posed by such sophisticated threats targeting popular platforms like Discord.
Jun 29, 2026