Executive Summary
The rapid adoption of Python as a malware development language has enabled threat actors to build highly modular and easily maintainable information stealers while leveraging commercial code protection frameworks to complicate analysis. Vanta Stealer exemplifies this trend by combining extensive credential harvesting capabilities with layered obfuscation techniques, allowing attackers to efficiently collect valuable user data while increasing the complexity of defensive analysis.
During our investigation, Point Wild Threat Intelligence observed that Vanta Stealer targets a broad range of applications and digital assets, including Chromium-based browsers, Discord, Telegram Desktop, Steam, Riot Games, Roblox, Minecraft, Mullvad VPN, cryptocurrency wallets, and locally stored sensitive documents. In addition to harvesting browser passwords, cookies, and stored payment information, the malware collects authentication tokens, gaming platform data, VPN configurations, cryptocurrency wallet files, screenshots, webcam captures, and documents containing wallet recovery phrases or private keys. The stolen information is consolidated into a structured archive before being exfiltrated to attacker-controlled infrastructure.
A notable characteristic of Vanta Stealer is its use of multiple PyArmor protection layers, combined with a PyInstaller-packaged executable, reflecting an emerging trend among Python-based malware families to adopt commercial software protection technologies as anti-analysis mechanisms. By introducing additional obfuscation layers, malware authors increase the effort required to inspect the underlying code, slowing reverse engineering efforts and delaying defensive response.
The malware’s modular execution flow demonstrates a deliberate strategy to maximize the value of each compromised endpoint. Rather than limiting its focus to browser credentials, Vanta Stealer systematically aggregates authentication artifacts, financial information, gaming accounts, communication platform sessions, cryptocurrency assets, and other high-value data into a single exfiltration package, increasing the potential impact of a successful compromise.
From a single click to complete data exfiltration, how does a seemingly legitimate Python executable hidden behind multiple layers of PyInstaller and PyArmor protection transform into a sophisticated information stealer capable of harvesting credentials, cryptocurrency wallets, gaming accounts, communication platforms, and sensitive user data within minutes of execution?
Attack Chain
Fig 1: Attack Chain
Potential Infection Vector
The analyzed sample does not contain functionality that directly reveals its initial delivery mechanism. However, based on its packaging, execution workflow, and targeted applications, Vanta Stealer is likely intended to be distributed through social engineering campaigns that rely on user interaction.
Potential infection vectors include:
- Phishing Emails: Malicious attachments or download links disguised as invoices, delivery notifications, or account-related documents.
- Trojanized Software: Fake installers, cracked software, or repackaged applications distributed through untrusted websites.
- Game Cheats and Mods: Malicious game modifications, cheat utilities, or launchers targeting users of platforms such as Steam, Riot Games, Roblox, and Minecraft.
- Fake Software Updates: Installers masquerading as browser, media player, or system updates to trick users into executing the payload.
- Malicious Code Repositories: Python projects or development tools hosted on public repositories that embed the stealer within seemingly legitimate packages.
- SEO Poisoning and Malvertising: Search engine manipulation and malicious advertisements that redirect users to attacker-controlled download pages.
Technical Analysis of Vanta Stealer
File Info:
Fig 2: Identified as a PyInstaller Executable
The static file-identification results produced by Detect It Easy (DIE) v3.10 on Windows 10 (x86_64) for a sample with a hashed filename. The analysis characterizes the target as a 64-bit Portable Executable (PE64), little-endian, AMD64-architecture GUI binary. The toolchain fingerprint indicates the executable was built for the Windows (Vista) subsystem and linked with Microsoft Linker 14.36.35222, compiled using Microsoft Visual C/C++ (19.36.35222) under Visual Studio 2022 (v17.6).
PyInstaller Archive Extraction: Recovering Bundled Python Artifacts via pyinstxtractor
Fig 3: Unpacking the PyInstaller CArchive
This figure shows the extraction stage, where the PyInstaller-packed executable is unpacked using pyinstxtractor. The tool reports PyInstaller 2.1+, target Python 3.10, an 80,092,917-byte CArchive, and 216 embedded files. Among the enumerated entry points, most are automatic runtime hooks (pyi_rth_*), while main.pyc represents the original application script and is the key target for later decompilation.
Locating the Primary Payload: Identification of main.pyc in the Extracted Archive
Fig 4: File-explorer view of the extracted PyInstaller directory, highlighting main.pyc (32 KB) as the primary application
This figure displays the extracted contents of the PyInstaller archive, confirming the recovery of the target application’s compiled bytecode. Among the unpacked artifacts, main.pyc (32 KB, compiled Python) is identified as the primary entry-point module and flagged as the file of interest for decompilation. Its relatively small size indicates it holds the application’s core logic rather than bundled dependencies.
Second-Layer Obfuscation: PyArmor-Protected Bytecode in the Decompiled main.pyc
Fig 5: Decompyle++ (pycdc) output of main.pyc (Python 3.10), revealing that the recovered source is protected by PyArmor
This figure shows the result of decompiling main.pyc with Decompyle++ (pycdc). Rather than yielding human-readable source, the output reveals a second layer of protection: the module imports from a pyarmor_runtime_000000 package and invokes the __pyarmor__ bootstrap function, the hallmark of a PyArmor-obfuscated script. The bulk of the file consists of a large encrypted/obfuscated byte-string payload that PyArmor decrypts and executes at runtime, meaning static decompilation alone cannot recover the original logic.
This indicates a layered defense-in-depth (or evasion) strategy: PyInstaller packaging on the outer layer (Figures 1–3), with PyArmor bytecode obfuscation protecting the core main.pyc
Deobfuscating main.pyc using PyArmor Shot
Fig 6: Successfully deobfuscated main.pyc using PyArmor Shot
To analyze the protected Python implementation, we successfully removed the PyArmor protection layer using PyArmor Static Unpack (OneShot). This process recovered the original Python bytecode (main.pyc), enabling comprehensive reverse engineering of Vanta Stealer’s execution workflow, modular architecture, and core malware functionality.
Fig 7: Recovered main.pyc illustrating Vanta Stealer’s primary execution
Execution Flow of Vanta Stealer
Fig 8: Vanta Stealer execution
Runtime Retrieval of a Dedicated Browser Credential Extractor
Fig 9: Vanta Stealer’s modular browser extraction workflow.
Unlike many information stealers that integrate browser credential theft directly into the primary payload, Vanta Stealer adopts a modular approach by downloading a dedicated browser extraction utility at runtime. This design not only allows operators to update browser harvesting capabilities independently but also minimizes changes to the primary malware, making long-term maintenance and feature updates significantly easier.
Discord Account Profiling and Token Enrichment
Fig 10: Vanta Stealer enriches stolen Discord tokens by retrieving account details, billing information, Nitro status, and server administrative privileges.
Rather than simply collecting Discord authentication tokens, Vanta Stealer performs additional account profiling by validating each recovered token against the Discord API. For every valid token, the malware retrieves the associated username, email address, phone number, user ID, Nitro subscription status, linked payment methods, and Discord server administrative privileges. This enrichment process transforms raw authentication tokens into comprehensive victim profiles, enabling threat actors to quickly identify high-value accounts with financial information or elevated administrative access.
Multi-Application Data Collection
Fig 11: Vanta Stealer invokes multiple collection modules to harvest
Following browser and Discord data collection, Vanta Stealer expands its harvesting routine by invoking dedicated modules targeting multiple applications and digital assets. The malware collects Steam account artifacts, cryptocurrency wallet files, Roblox data, Mullvad VPN configurations, Valorant-related information, and sensitive documents discovered on the compromised system. The collected Discord tokens and enriched account information are then consolidated into a structured data object, preparing all harvested artifacts for archive generation and subsequent exfiltration. This modular design enables the malware to efficiently aggregate data from diverse sources during a single execution.
| Module | Purpose |
| Steam | Gaming account collection |
| Crypto Wallets | Wallet discovery |
| Roblox | User/session artifacts |
| Mullvad | VPN configuration |
| Valorant | Riot Games data |
| Sensitive Files | Documents & recovery phrases |
Comprehensive Data Inventory and Summary Generation
Fig 12: Vanta Stealer generates a Summary.txt report that inventories harvested artifacts and categorizes the collected data before archive generation.
Following data collection, Vanta Stealer generates a structured inventory of the harvested artifacts before completing the exfiltration process. The malware records the number of collected browser passwords, cookies, credit cards, Discord tokens, Discord accounts, Steam files, cryptocurrency wallets, Roblox data, Telegram artifacts, screenshots, Minecraft data, Mullvad VPN configurations, Valorant files, and sensitive documents into a dedicated Summary.txt report.
By producing this consolidated summary, the malware enables operators to quickly assess the value of a compromised system without manually reviewing each harvested file. The routine also stores browser cookies in a dedicated directory, further organizing the stolen data prior to archive generation and exfiltration.
Archive Generation and Data Exfiltration
Fig 13: Vanta Stealer generates a consolidated ZIP archive and uploads it to a remote server together with victim-specific metadata using an HTTP POST request.
Upon completing all collection routines, Vanta Stealer invokes the create_complete_zip() function to consolidate the harvested artifacts into a single compressed archive. The generated ZIP package includes system information, browser credentials, cookies, Discord account data, gaming platform artifacts, cryptocurrency wallet files, VPN configurations, and sensitive documents collected during execution.
Before transmitting the archive, the malware constructs a metadata object containing a unique victim identifier (userId), username, and execution mode (hitType), enabling the operator to associate uploaded data with a specific victim or campaign. The archive is then uploaded to a predefined command-and-control endpoint using an HTTP POST request, where both the ZIP file and victim metadata are transmitted together.
The upload routine validates the server response and records the transaction status, indicating successful exfiltration upon receiving an HTTP 200 OK response. Additionally, the implementation includes error handling for oversized uploads (HTTP 413), suggesting that the malware is designed to operate against a managed backend infrastructure with predefined upload limitations.
This workflow demonstrates that Vanta Stealer follows a structured collect → package → identify → exfiltrate execution model, ensuring that harvested data is not only organized into a single archive but also linked to individual victims for efficient management within the attacker’s infrastructure.
Conclusion
Vanta Stealer highlights the evolution of modern Python-based information stealers, combining extensive data harvesting with layered anti-analysis techniques to maximize the impact of a single compromise. By targeting browsers, communication platforms, gaming applications, cryptocurrency wallets, and sensitive documents, the malware demonstrates how attackers are expanding their focus beyond traditional credential theft.
Through this analysis, Point Wild Threat Intelligence provides insights into Vanta Stealer’s execution workflow, collection methodology, and layered PyArmor protection, helping researchers and defenders better understand the techniques employed by emerging Python-based malware families and the evolving threat landscape.
Detection and Mitigation
UltraAV, powered by Point Wild, helps defend against such threats by focusing on initial-stage files received from various sources, including abused GitHub Pages, compromised websites, Social engineering campaigns, and trojanized applications disguised as legitimate software installed by users.
Fig 14: Detection with UltraAV
As threats like Vanta Stealer continue to rise, so does the need for robust antivirus software. Whether you’re working, gaming or shopping, let UltraAV safeguard your digital life. Download UltraAV now and stay safe from malware, viruses and emerging threats like Vanta Stealer.
Following are the IOCs belonging to this campaign
| 3bff25e745707056cf4ed6428ee8aace9a1bff2fb4030e32a7c0470a34cbfa62 |
| 4bdf15157fc0067af179d11e9ad168816ce99a849fd45332482b0b88a05aeabb |
| 5dbddac39fda06acc703c22935fa24e0b4bcdbc26624a1869fe93cd568cdb9fc |
| 6f20836eef6496695e5f2a5fd81e7dfb8770df38fb1bf67fcf024c1261352daa |
| 09e3ce307b2af3f94a315eba97c094d8d755b3674208cc47ceab3c1630a84ad9 |
| 026c85b97a6ddac14c9835d0580228c0a82dd82ce12d8d921c2f3067a12bbb7e |
| 31f3e50e764a090d2dbf759e6cb5f678c5c6a3a5a96ff3a2069ffda520580e52 |
| 34a01c2429161a8711adff3495ab1dee4419511c8f45c483f50ac71205f68512 |
| 44d48b4876cc99f1781877eae9d1e22e99925079a5a8cd0d9022176f5757baaf |
| 64d85df47edd0187462786ff290f34b080f909a5dda946fa7e83fa3f40aaa878 |
| 96cc8dc992e465f5f959c7d1481e3789067a78c83706a3dd7ba5a20eaf32b701 |
| 467c192e3aeafbac29ab272575bc76545f371a50670fb4a1cf3104dae30622e0 |
| 785d6372f397470c48faa0a9a525b91cb990d0b3ed4b6452e31d75ed179a409c |
| 858fcd9bd05d73d2dcc1496761e2f71fd0bf75fa0ae66eeb7405f788837ec384 |
| 3349f0cf1d4f294d7d98ee12e0ce03a40740668b50e5e553d843f233a0021d36 |
| 9339c056663e9f57d4b9d34b339cd85048176b9e7d9a20958b7ba190964acd47 |
| a71c4149bcb8a77ca755ff235e91b1e774293cf3d653aaa2c41fe943cd0848f1 |
| aa9268a758b5333d725b4b08350ec35e05b9a86f02d65b83b2d9a51e8859b5cd |
| b6a7d57fb37a0d9dab8a9e1a81ac6c228fefa4375611bbdf847a775c66cf96c5 |